"Lost connection to the server" in editor + "Invalid origin" WebSocket error behind Plesk reverse proxy

Questions
1

Hi everyone,

I’m running n8n self-hosted via Docker Compose behind Plesk (Ubuntu 20.04,
Plesk Obsidian 18.0.78), with nginx as reverse proxy in front of Docker.

Setup:

  • n8n official Docker image (n8nio/n8n)
  • Reverse proxy: Plesk’s nginx (proxying to Apache, then to Docker container
    on port 5678)
  • Domain: subdomain with its own SSL (Let’s Encrypt via Plesk)

Environment variables already set:
N8N_HOST=bot.publicides.com
N8N_PORT=5678
N8N_PROTOCOL=https
WEBHOOK_URL=https://bot.publicides.com/
N8N_SECURE_COOKIE=false
N8N_TRUST_PROXY=true
N8N_PROXY_HOPS=2
N8N_PUSH_BACKEND=sse
N8N_EDITOR_BASE_URL=https://bot.publicides.com/

Nginx additional directives already added:
proxy_read_timeout 300s;
proxy_connect_timeout 300s;
proxy_send_timeout 300s;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection “upgrade”;
proxy_set_header Host $host;
proxy_pass_request_headers on;

Problem:
Any live editor action (Execute previous nodes, Test this trigger, even
just opening the Executions tab) fails with “Problem running workflow —
Lost connection to the server” in the UI.

Docker logs show this repeating error:

Origin header does NOT match the expected origin. (Origin: “undefined”
→ “N/A”, Expected: “undefined” → “undefined”, Protocol: “undefined”)
ResponseError: Invalid origin!
at Push.handleRequest (/usr/local/lib/node_modules/n8n/src/push/index.ts:157:10)
at /usr/local/lib/node_modules/n8n/src/push/index.ts:112:17
at Layer.handleRequest (…router/lib/layer.js:152:17)
…
at /usr/local/lib/node_modules/n8n/src/auth/auth.service.ts:158:18

What I’ve already ruled out:

  • Server resources are fine (RAM ~72% used but plenty of headroom, low CPU,
    low disk usage)
  • Not a browser/cache issue — same error in incognito mode, different
    browser, different device, and mobile data instead of WiFi
  • Docker container is up and healthy (docker ps confirms “Up”)
  • Webhooks work fine — a manual curl POST to the production webhook URL
    returns {“message”:“Webhook call received”} and the workflow executes
    correctly end-to-end (confirmed via the target Google Sheet being updated)
  • Domain is NOT proxied through Cloudflare (DNS only / grey cloud)

So the actual workflow execution via webhook works perfectly — only the
live editor’s WebSocket/SSE push connection fails, seemingly rejected
because of an Origin header mismatch somewhere between nginx and n8n’s
auth service.

Has anyone run into this specific “Invalid origin” push error with
Plesk’s nginx setup? Is there an additional env var or nginx directive
needed to correctly forward/set the Origin header for the push endpoint?

Thanks in advance!

2

Hi @Alcides_Home_360_Bel Welcome!
n8n 1.87+ added a strict Origin check on the push endpoint (/rest/push), and your log showing Origin, Expected, and Protocol all “undefined” means the Origin header is being stripped before it reaches n8n, so the check rejects the push connection while webhooks, which have no such check, keep working. Env toggles like N8N_DISABLE_ORIGIN_CHECK are widely reported to do nothing once the header is already gone, so the real fix is to inject the Origin header, with the scheme, at the proxy hop closest to n8n.
In your Plesk chain that hop is Apache, not the front nginx. Another Plesk user set Origin only in the nginx directives and still saw “Origin: undefined” because the Apache layer in between drops it. So set it in the Apache directives (Websites & Domains, Apache & nginx Settings, Additional Apache directives) with mod_headers:
See this:

Use https://bot.publicides.com as the value, and add RequestHeader set X-Forwarded-Proto "https" as well, since your log shows Protocol undefined too. Keeping N8N_PUSH_BACKEND=sse is fine; the check applies to SSE and WebSocket alike, so SSE alone does not skip it.
If you would rather not touch Apache, uncheck “Proxy mode” in the same Apache & nginx Settings so nginx proxies straight to the container, then your existing nginx block plus proxy_set_header Origin https://bot.publicides.com; reaches n8n directly.