How to prevent other users from intercepting "/form-waiting/{id}" and completing the next form page?

[kdh949]

Describe the problem/error/question

Hello,

I’ve built a multi-step form using Form Trigger > Next Form Page > Form Ending.
However, I’ve found a potential issue.

After the first form submission, the workflow moves to a Next Form Page (served under /form-waiting/{number}).
Until the original user submits that page, anyone who guesses or changes the numeric ID in the URL can access that intermediate form and complete it themselves.

In my case, the next page even displays the values entered in the first form.
So if someone intercepts it, they can both view and overwrite another user’s data.

I’d like to keep the multi-step form behavior but prevent this kind of interception.

Is there a built-in way to protect the /form-waiting/{id} page or replace the sequential numeric ID with a UUID or another opaque token?

If not, what’s the recommended approach to ensure only the original user can continue their own form session?
(e.g., using short-lived signed tokens, requiring authentication on the Next Form Page, or redirecting through a protected webhook)

Thanks for any guidance or best practices!

What is the error message (if any)?

Please share your workflow

Share the output returned by the last node

Information on your n8n setup

• n8n version: 1.114.4
• Database (default: SQLite): SQLite
• n8n EXECUTIONS_PROCESS setting (default: own, main): own, main
• Running n8n via (Docker, npm, n8n cloud, desktop app): Docker
• Operating system: ubuntu 24.04.3 LTS

[mohamed3nan]

@kdh949

After the first form submission, the workflow moves to a Next Form Page (served under /form-waiting/{number})

Yes, I believe this is a limitation when using Next Form Page, Even if you start a form using a token, for example:

https://n8n.example.com/form/form-path?token=something

when the Next Form Page node is used, you’ll always be redirected to the path /form-waiting/{id} without any parameters, so it’s not possible to use any authentication logic.

A possible workaround is to always use a Form Ending node that redirects to another form with auth logic, not ideal, but it should work i guess..

[kdh949]

Thank you for your help.
I will proceed based on your suggestion.

+) I think it would be good for the n8n team to consider using UUIDs in the future to prevent such issues.