n8n-nodes-secure-webhook

A temporary custom n8n node that works exactly like the built-in Webhook node
but redacts sensitive headers (Authorization, Cookie, etc.) from execution output.

Why? n8n PR #29825 will add this natively.
Until it is merged and released, use this node as a drop-in replacement.

What It Redacts

Always redacted (hardcoded):

| Header | |---------------------| | authorization | | cookie | | x-api-key | | x-auth-token | | proxy-authorization | | sslclientcert |

You can add more via the "Extra Headers to Redact" field in the node settings.

Build

cd n8n-nodes-secure-webhook
npm install
npm run build
# Output is in ./dist/

Deploy — Docker / Kubernetes

Option A: Bake into your Docker image (recommended)

In your Dockerfile (for worker or main image), add:

# Copy the built package
COPY n8n-nodes-secure-webhook /opt/n8n-nodes-secure-webhook

# Install it globally so n8n can find it
RUN cd /opt/n8n-nodes-secure-webhook && npm install --production && \
    npm link && \
    npm link n8n-nodes-secure-webhook

# Tell n8n where to find custom nodes
ENV N8N_CUSTOM_EXTENSIONS="/opt/n8n-nodes-secure-webhook"

Option B: Startup script (no image rebuild)

In your startup.sh, before exec n8n:

# Install custom node
cd /opt/n8n-nodes-secure-webhook && npm install --production
export N8N_CUSTOM_EXTENSIONS="/opt/n8n-nodes-secure-webhook"

Mount the built dist/ folder as a volume to the container, then set:

# In your K8s envs.yaml or docker-compose env section:
- N8N_CUSTOM_EXTENSIONS=/opt/n8n-nodes-secure-webhook

Option C: ~/.n8n/custom directory

Place the built package inside /home/node/.n8n/custom/n8n-nodes-secure-webhook/
n8n auto-discovers packages in that directory.

mkdir -p /home/node/.n8n/custom
cp -r ./dist /home/node/.n8n/custom/n8n-nodes-secure-webhook
cp ./package.json /home/node/.n8n/custom/n8n-nodes-secure-webhook/

Environment Variable

Set this in all main + worker pods:

N8N_CUSTOM_EXTENSIONS=/opt/n8n-nodes-secure-webhook

For your sales server S3 secret paths:

• prod/secrets/sales/main/ — add N8N_CUSTOM_EXTENSIONS
• prod/secrets/sales/worker/ — add N8N_CUSTOM_EXTENSIONS

Usage

1. In your workflow, delete the existing Webhook node
2. Add a Secure Webhook node (appears in the trigger nodes panel with a 🔒 icon)
3. Configure the same Path, HTTP Method, and Response Mode
4. The output format is identical to the built-in Webhook node — no downstream changes needed

Migration Checklist

• [ ] Build the package (npm run build)
• [ ] Deploy to all servers (main + workers need the env var)
• [ ] Replace Webhook nodes in sensitive workflows with Secure Webhook
• [ ] Test with a real request — confirm [REDACTED] appears for authorization in execution UI
• [ ] When n8n merges PR #29825 and you upgrade, switch back to the built-in Webhook node

Output Format

Same as the built-in Webhook node:

{
  "headers": {
    "content-type": "application/json",
    "authorization": "[REDACTED]",
    "cookie": "[REDACTED]",
    "user-agent": "PostmanRuntime/7.51.1"
  },
  "params": {},
  "query": {},
  "body": { "name": "Mustafa" },
  "webhookUrl": "https://your-n8n.com/webhook/my-path",
  "executionMode": "production"
}