Form trigger workflows and Send-and-Wait steps in n8n apply Content Security Policy sandbox headers to their HTML pages. In some environments — particularly those with certain proxy configurations — this protection causes infinite loops or prevents forms from loading correctly. A new environment variable provides an escape hatch for these edge cases.

Setting N8N_INSECURE_DISABLE_FORM_HTML_SANDBOX=true disables the CSP sandbox headers for Form Trigger, form completion pages, and Send-and-Wait workflows. The change applies across the form-related code paths in the CLI and nodes-base packages.

The feature carries a warning in the configuration: disabling CSP protection exposes instances to attacks where malicious workflows can make requests using other users' credentials. The documentation recommends configuring forms to be served from a different subdomain as the correct mitigation. This environment variable is intended as a last resort for infrastructure that cannot be restructured.

The refactoring also consolidates CSP-related utilities by renaming getHtmlSandboxCSP from its webhook-specific naming, reflecting that the same sandbox directive applies to both webhook and form pages.