The Problem
If you serve custom HTML pages via the Respond to Webhook node on n8n Cloud, you’ll find that links trying to open other n8n Cloud pages (like execution detail pages) are blocked. This affects any anchor tags with target=“_blank” and window.open() calls pointing to your n8n Cloud instance.
The root cause is two layered security restrictions:
-
Iframe Sandbox — Since n8n v1.103.0, all HTML served via “Respond to Webhook” is wrapped in a sandboxed iframe using srcdoc (see GitHub issue #17760)
-
Cross-Origin-Opener-Policy: same-origin — Set at n8n Cloud’s infrastructure level (Cloudflare/reverse proxy)
Together, these prevent webhook-served HTML from opening new tabs/windows to your n8n Cloud instance.
What I Tested
I was building a Data Table explorer — a webhook-served HTML page with a results table where each row links to an n8n execution. Here’s what I tried:
| Approach | Result |
|---|---|
| Anchor tag with target=“_blank” | Blocked |
| Anchor tag with target=“_blank” and rel=“noopener noreferrer” | Blocked |
| window.open() call | Blocked |
| Clipboard copy fallback | Works, but poor UX |
| Plain anchor tag, no target attribute | Works! |
The Solution
Use plain same-tab links — a regular anchor tag with just an href and no target=“_blank”. Point it to your execution URL like:
your-instance.app.n8n.cloud/workflow/abc123/executions/456
This works because the iframe sandbox includes allow-top-navigation-by-user-activation, which permits navigating the top-level frame when triggered by a user click.
The tradeoff is that clicking navigates away from your results page (instead of opening a new tab), but it’s the only reliable approach that actually works on n8n Cloud today.
Why It Works
The sandbox attributes on n8n’s iframe wrapper include allow-top-navigation-by-user-activation. This means a direct user click on a plain link is allowed to navigate the top frame. However, opening a new browsing context (via target=“_blank” or window.open()) gets blocked by the combination of the sandbox and COOP policy.
Environment
-
n8n Cloud v2.6.3
-
Tested February 2026
-
Using Respond to Webhook node (typeVersion 1.1) with Content-Type text/html
Note: The environment variable N8N_INSECURE_DISABLE_WEBHOOK_IFRAME_SANDBOX exists for self-hosted instances (see PR #17851), but on n8n Cloud you likely cannot set environment variables depending on your plan.
Hope this saves someone else the debugging time!