I can't disable the webhook sandbox in n8n in the env variables

Questions
1

Good evening!

I have a flow in n8n that consists of: webhook (GET) → JavaScript with HTML → respond to webhook.

The page is a login page, and when it tries to set a cookie on the page, I get the following error:
“Failed to set the ‘cookie’ property on ‘Document’: The document is sandboxed and lacks the ‘allow-same-origin’ flag.”

After some research, I found out that this happens because of a change in n8n, where now every HTML page is loaded inside an iframe/sandbox.

I saw that it’s possible to disable this using an environment variable:
N8N_INSECURE_DISABLE_WEBHOOK_IFRAME_SANDBOX, which, when set to true, disables it.

However, even after disabling it, it still doesn’t work. I’m testing this locally using Docker Desktop, and it’s not working. Even after disabling it, I still get the same error shown above.

image
image643×840 66 KB

I’m using a basic n8n installation setup as shown in the official documentation, the only difference is the last environment variable I added to disable this feature.

The workflow in question is one I found in a video, and the creator made it available. The workflow is in the link below.

2

Looking at your issue, it seems like you’re experiencing the same problem reported in [github.com](allow-same-origin problem in latest version(1.112.6) · Issue #20081 · n8n-io/n8n · GitHub) with version 1.112.6. The environment variable `N8N_INSECURE_DISABLE_WEBHOOK_IFRAME_SANDBOX=true` should work, but make sure you’re restarting your Docker container completely after setting it.

Try these steps:

• Stop your Docker container completely

• Add the environment variable `N8N_INSECURE_DISABLE_WEBHOOK_IFRAME_SANDBOX=true` to your Docker configuration

• Start the container again and test

If it still doesn’t work, you might need to downgrade to an earlier version temporarily while the n8n team addresses this issue, or consider using the [docs.n8n.io](Security environment variables | n8n Docs) Content-Security-Policy environment variable `N8N_CONTENT_SECURITY_POLICY` to allow same-origin access.