Module 11 Lesson 2: Securing Webhooks

If you create a Webhook like https://n8n.com/my-webhook, anyone in the world who finds that URL can trigger your workflow. If that workflow "Sends a $100 Refund," you have a problem.

1. Authentication Methods

The Webhook node has a "Security" section:

• None: Open to the public. (Never use for sensitive things!).
• Basic Auth: Requires a Username and Password in the browser/client.
• Header Auth: Requires a specific "Secret Key" in the headers (e.g., X-N8N-SECRET: abc123).

---

2. IP Allow-listing

In your server settings (or n8n environment variables), you can restrict webhooks so they only accept traffic from a specific IP.

• Scenario: "Only allow webhooks from Stripe's official IP addresses."
• This is the ultimate defense against "Spoofing" attacks.

---

Visualizing the Process

graph TD
    Start[Input] --> Process[Processing]
    Process --> Decision{Check}
    Decision -->|Success| End[Complete]
    Decision -->|Retry| Process

---

3. Secret Validation (The Logic Layer)

Even without the built-in auth, you can add an IF Node as your very first step.

• "Does the incoming payload contain secret_token == 'my-long-random-string'?"
• If NOT, use a Respond to Webhook node to return a "401 Unauthorized" error.

---

4. Why Security Matters for Webhooks

• Cost Control: Every execution on n8n Cloud costs money. You don't want bots running your workflow 1,000,000 times.
• Data Integrity: You don't want "Fake Leads" being added to your CRM.
• Action Protection: You don't want a hacker to "Trigger a Deploy" or "Delete a Database."

---

Exercise: The Fortress Gate

1. Create a Webhook node. Set authentication to "Header Auth."
2. Try to visit the URL in your browser. Do you get an error?
3. Use a tool like curl to send the request WITH the correct header. Did it work?
4. Why is it safer to use n8n's Built-in Auth rather than an IF Node for security? (Hint: The IF node still records an execution in the log).
5. Research: What is "HMAC Verification" in webhooks and does n8n support it? (Used by Shopify and GitHub).

---

Summary

Webhooks are your "Public Door." By securing them with headers, secrets, and IP filters, you ensure that only trusted partners can enter your system and that your automation remains a secure asset for your company.

Next Lesson: The hidden layer: Environment Variables for Security.