Google OAuth2 behind Cloudflare fails with 414 URI Too Long on /rest/oauth2-credential/auth

Questions
1

Describe the problem/error/question

Hi,

I am self-hosting n8n on a home server and exposing it publicly behind Cloudflare (proxied DNS). When I try to create a Google OAuth2 credential and click “Sign in with Google”, the request to:

GET https:///rest/oauth2-credential/auth?..very long query…

fails with:

414 URI Too Long

Server: cloudflare

So Cloudflare rejects the request before it reaches my n8n instance.
From the browser Network tab I can see that the query string contains:

  • homeProject=... – a large JSON blob with the current project info
  • scopes=[ ... ] – a long list of n8n RBAC scopes (credential:, workflow:, user:*, etc)
  • All Google OAuth settings (auth URL, token URL, clientId, scopes, etc)
    This combined payload makes the URL extremely long. After I added more Google scopes (YouTube related), the request started to hit Cloudflare’s URL length limit and now consistently returns 414.

n8n editor serializes:

your project (homeProject)
your RBAC scopes (scopes=[…])
the OAuth config (URLs, clientId, clientSecret, Google scopes)
into one GET request to /rest/oauth2-credential/auth.

Axios / browser URL encoding

Expands characters (: / spaces etc → %3A, %2F, %20), which increases length.

Cloudflare

Enforces a maximum allowed request line (method + path + query).
When your particular combination crosses that threshold, it returns 414 URI Too Long.
No exotic extension, no weird Google behavior. Just:

Big query + encoding + strict CDN = 414.

Questions

  1. Is it expected that /rest/oauth2-credential/auth includes homeProject and the full internal scopes array in the query string instead of the request body?
  2. Is there any configuration to:
    • change this request to POST with a body, or
    • avoid sending so much internal state in the URL?
  3. Has anyone else seen 414 URI Too Long on this endpoint when running n8n behind Cloudflare, and if so, how did you resolve it (bypass Cloudflare for this host/path, adjust n8n config, etc)?
    Thanks!

What is the error message (if any)? 414

Please share your workflow

Just trying to login into google via credentials.

Share the output returned by the last node

https:///rest/oauth2-credential/auth
?id=
&homeProject={…large project JSON with role + scopes…}
&scopes=[
“annotationTag:create”,
“annotationTag:delete”,
“credential:create”,
“credential:delete”,
“credential:list”,
“workflow:create”,
“workflow:read”,
“workflow:update”,
“user:create”,
“user:list”,
“user:update”,
… many more internal n8n scopes …
]
&useDynamicClientRegistration=false
&grantType=authorizationCode
&authUrl=https%3A%2F%2Faccounts.google.com%2Fo%2Foauth2%2Fv2%2Fauth
&accessTokenUrl=https%3A%2F%2Foauth2.googleapism%2Ftoken
&clientId=
&clientSecret=
&scope=https%3A%2F%2Fwww.googleapism%2Fauth%2Fyoutube%20
https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fyoutubepartner%20
https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fyoutube.force-ssl%20
https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fyoutube.upload%20
https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fyoutubepartner-channel-audit
&authQueryParameters=access_type%3Doffline%26prompt%3Dconsent
&authentication=body
&sendAdditionalBodyProperties=false
&allowedHttpRequestDomains=all
&allowedDomains=

Information on your n8n setup

  • n8n version: The newest
  • Database (default: SQLite): Sqlite
  • n8n EXECUTIONS_PROCESS setting (default: own, main): idk
  • Running n8n via (Docker, npm, n8n cloud, desktop app): Docker
  • Operating system: Umbrel OS
2

Try creating a custom waf rule in Cloudflare that skips the http_request_firewall_managed phase for your n8n oauth endpoint.

If you try it, let me know if it works.

3

Didnt work. But thanks

The explanation:

Why your Cloudflare WAF skip rule did nothing

You tried:

skip http_request_firewall_managed for /rest/oauth2-credential/auth.

That cannot fix this, because:

  • The WAF runs after the edge has accepted the HTTP request.

  • Your problem is that the edge refuses the request line itself (URI too long) and returns 414 before it ever gets to WAF evaluation.

  • A WAF skip or allow rule only controls managed rules, not core HTTP parser limits or “maximum URL length” settings.

So:

  • 414 is not a WAF decision.

  • Changing WAF rules will never change this behavior.

4

The problem was a bug from n8n side. For some reason the get request for OAuth appends scopes and settings for admin user, but not for classic user. So what i do is create credentials on one account and use it on another.