Security concern due to data exposure

Questions
1

Hi,

Our security team alerts me on potential security issues as node js version, app version and other information are publicly displayed in /rest/settings route.

Is there a way to hide them?

Attackers can easily use vulnerability templates (e.g., for bug bounty programs) to exploit this kind of data exposure.

  • n8n version: latest
  • Database (default: SQLite): postgres
  • n8n EXECUTIONS_PROCESS setting (default: own, main): default
  • Running n8n via (Docker, npm, n8n cloud, desktop app): docker
  • Operating system: linux
2

hello @Anthony_Brebion

AFAIK, n8n team plans to hide that endpoint in the future release.

However, that endpoint doesn’t contain any sensitive info. Currently you can hide it with a path rule for your reverse proxy

3

How can I do that? I have the same issue here. If I setup after a proxy-manager and doploy the docker the n8n_proxy_hops has to have the value 1?

4

It’s a simple path rule with something like:

  • path condition: /rest/settings
  • action: block

The exact configuration depends on the reverse proxy / ALB that you are using

5

Thanks I will try it. Now I have to deploy all the system again to run after the proxy-manager.

6

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.