Module 11 Lesson 3: Security Environment Variables
DNA level security. Learn the critical environment variables that control n8n's encryption, session management, and external command blocking.
Module 11 Lesson 3: Security Environment Variables
The most important security settings in n8n aren't in the UI; they are in your docker-compose.yml. These variables define how the "Core" of n8n behaves.
1. N8N_ENCRYPTION_KEY (The Master Key)
This is a random string used to encrypt all your API keys and passwords in the database.
- Rule: If a hacker steals your database file but DOES NOT have this key, they cannot read any of your passwords.
- Warning: Do not use
12345. Use a long, random string.
2. N8N_BLOCK_ENV_VARS_IN_CODE
By default, the Code Node can read any environment variable on your server (including your DB passwords!).
- Security Check: Set this to
trueto prevent custom code from seeing sensitive server configuration.
3. Disabling Dangerous Nodes
If you have a team of junior developers, you might want to prevent them from running bash commands on the server.
N8N_BLOCK_NODES: You can list nodes to be disabled (e.g.,n8n-nodes-base.executeCommand).- This turns off the "Execute Command" node for the entire instance.
4. Session Security
N8N_SESSION_COOKIE_TIMEOUT: How long until the user is logged out (e.g.,24hours).N8N_JWKS_URI: Used for integrating with enterprise Identity Providers (Okta/Auth0).
Exercise: The Hardening Test
- Add
N8N_BLOCK_ENV_VARS_IN_CODE=trueto your docker-compose. - In n8n, try to write a Code node that does
console.log(process.env.DB_PASSWORD). Does it still work? - Research: Why is it important to rotate your
N8N_ENCRYPTION_KEYif an employee with Admin access leaves the company? (Search for "n8n encryption key rotation tool"). - How do you hide the "Registration" screen for new users once the main admin is setup? (
N8N_USER_MANAGEMENT_DISABLED).
Summary
Security environment variables are the "Guardrails" of your automation platform. By properly configuring encryption and blocking dangerous features, you build an environment where your team can be creative without accidentally creating a massive security hole.
Next Lesson: Watching the watchers: Auditing Executions and Credential Usage.