n8n check · webhook security
n8n Webhook Security: Review Authentication Before Side Effects
A Webhook is a workflow entry point. Before it can reach a business side effect, review the authentication and signature boundary visible in n8n and any protection implemented upstream.
What is this risk?
The n8n Webhook node supports built-in authentication choices such as Basic auth, Header auth, JWT auth, and None. An API gateway, reverse proxy, or signature verifier may add controls outside the exported workflow.
The security question is not simply whether a webhook is public. It is whether request authenticity is verified before a path can create, update, send, delete, or otherwise mutate external state.
Typical failure pattern
An unverified request reaches a real side effect
- Public webhook request
- No explicit authentication visible in the export
- Trigger-reachable workflow path
- External create, update, send, or delete operation
Why it matters
- An attacker or accidental caller may be able to replay an event or trigger a business action if request authenticity is not checked.
- Even a correctly configured Webhook node may depend on gateway, signature, rate-limit, and downstream authorization controls that need separate evidence.
Auturance signals
WS002Webhook has no explicit authentication
This is the current scanner signal associated with this check.
WS004Unauthenticated webhook may reach an external side effect
This is the current scanner signal associated with this check.
What Auturance checks
- Flags enabled Webhook nodes whose exported authentication mode is empty or set to None.
- Raises a separate signal when that webhook can reach a detected external side effect.
- Shows the signal as a review question and does not infer controls outside the exported graph.
What Auturance cannot determine
- It cannot inspect a reverse proxy, API gateway, WAF, signature service, or sender configuration that is not in the export.
- It cannot verify credential strength, caller identity, rate limits, or whether a request was actually accepted.
- An upstream control may make a static signal intentional; document it before dismissing the finding.
How to reduce the risk
- Use an appropriate built-in authentication mode when the sender supports it.
- Verify a signature or shared secret before the first external side effect when public delivery is required.
- Document gateway, replay protection, rate-limit, and downstream authorization controls outside n8n.
Related checks
Related resource
Start with the n8n workflow audit guide for the broader production-readiness review.
Related guide
See what your workflow reveals
Upload an authorized n8n export and review the static signals in its actual graph.