GCP - N8N on CloudRun with LB - WAF rules

Questions
1

I am just setting up n8n on Cloud Run with Cloud SQL, exposed via HTTPS LB.

One open point is WAF (Cloud Armor).

Any suggestions from your experience on:

  • Extra WAF rules worth adding for n8n?

    • thinking about rate limiting to prevent brute forcing
    • some API endpoint protections
    • core web vulnerabilities (SQL Injection, XSS, etc.)
    • Vulnerability Scanner Blocking

  • Other gotchas or best practices when exposing n8n publicly?

Thanks in advance!

2

Welcome to the n8n community @rgrzesk

Follow these steps to ensure your n8n setup is secure and protected against common web vulnerabilities.

  1. Enable preconfigured rules for SQL injection, XSS, and rate limiting.
  2. Prevent brute-force attacks on API endpoints.
  3. Regularly review logs and adjust rules as needed.
  4. Apply different security policies for n8n UI and webhooks.
  5. Add an extra layer of security for accessing n8n UI and webhooks.

Hope this helps