Issue Station
Sign In
Tools hereToolbox

n8n - ✅(Solved) Fix OAuth2 token requests bypass proxy when Ignore SSL Issues is enabled [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
n8n-io/n8n#28576•Fetched 2026-04-17 08:54:54
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
0
Author
shaun0927shaun0927
Participants
shaun0927shaun0927
Timeline (top)
cross-referenced ×1

Root Cause

#28225 / #28513 fixed the older double-proxy issue caused by missing proxy: false.

Fix Action

Fixed

PR fix notes

PR #28578: fix: Preserve OAuth2 proxy routing when Ignore SSL Issues is enabled

Description (problem / solution / changelog)

Summary

This PR fixes a follow-on OAuth2 transport issue after #28513.

@n8n/client-oauth2 correctly disables axios's built-in proxy handling with proxy: false, but when ignoreSSLIssues=true it currently swaps in a per-request https.Agent({ rejectUnauthorized: false }).

In proxy-based deployments, that per-request agent bypasses n8n's global HttpsProxyManager path, so OAuth2 token requests can fail before they ever reach the proxy.

This change keeps the Ignore SSL Issues behavior but preserves proxy routing by delegating through the current global HTTPS agent and forcing TLS validation off on the forwarded request.

It also adds regression coverage for the ignoreSSLIssues transport choice in @n8n/client-oauth2.

Related Linear tickets, Github issues, and Community forum posts

fixes #28576

Review / Merge checklist

  • I have seen this code, I have run this code, and I take responsibility for this code.
  • PR title and summary are descriptive. (conventions)
  • Docs updated or follow-up ticket created.
  • Tests included.
  • PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

Changed files

  • packages/@n8n/client-oauth2/src/client-oauth2.ts (modified, +19/-2)
  • packages/@n8n/client-oauth2/test/client-oauth2.test.ts (modified, +42/-0)
RAW_BUFFERClick to expand / collapse

Bug Description

After the fix in #28513, there is still a follow-on OAuth2 transport bug when Ignore SSL Issues (Insecure) is enabled on an OAuth2 credential.

@n8n/client-oauth2 now correctly sets proxy: false, but when ignoreSSLIssues=true it also swaps in a per-request https.Agent({ rejectUnauthorized: false }).

In proxy-based deployments, that custom agent bypasses n8n's global HttpsProxyManager routing, so OAuth2 token requests can fail before they ever reach the proxy.

Why this is different from #28225

#28225 / #28513 fixed the older double-proxy issue caused by missing proxy: false.

This report is about a different follow-on case:

  • proxy routing works when the global n8n HTTPS proxy agent is used
  • proxy routing breaks when ignoreSSLIssues=true replaces that path with a custom per-request agent

To Reproduce

I reproduced this locally against the current merged behavior using a minimal harness:

  1. Start a local HTTPS token endpoint with a self-signed certificate
  2. Start a local HTTP CONNECT proxy
  3. Use an unresolvable hostname like oauth-target.invalid for the OAuth2 token URL
  4. Configure the request so it can only succeed if it actually goes through the proxy
  5. Compare:
    • control: proxy: false + global proxy agent
    • current behavior: same request + ignoreSSLIssues=true

Expected behavior

Enabling Ignore SSL Issues should disable TLS verification without changing the proxy routing path.

Actual behavior

With ignoreSSLIssues=true, the request bypasses the proxy path and fails with DNS resolution errors before the proxy is used.

Local verification summary

Control case:

  • request succeeds
  • proxy receives CONNECT oauth-target.invalid:443
  • token endpoint receives the POST request

Current merged behavior:

  • request fails with ENOTFOUND oauth-target.invalid
  • proxy receives no CONNECT
  • token endpoint is never reached

Relevant code

Current behavior is in:

  • packages/@n8n/client-oauth2/src/client-oauth2.ts
  • packages/core/src/http-proxy.ts
  • packages/nodes-base/credentials/OAuth2Api.credentials.ts

The root cause is that ignoreSSLIssues currently swaps in a custom httpsAgent, while n8n proxy support relies on the global HTTPS agent path.

Environment

  • self-hosted / proxy-based deployment
  • OAuth2 credential with Ignore SSL Issues (Insecure) enabled
  • custom / intercepted / self-signed certificate in the path

This looks like a supported deployment scenario rather than an out-of-scope edge case, since n8n explicitly exposes the Ignore SSL Issues option in the OAuth2 credential UI.

extent analysis

TL;DR

The most likely fix is to modify the @n8n/client-oauth2 package to use the global HTTPS agent with rejectUnauthorized: false when ignoreSSLIssues=true, instead of swapping in a custom per-request agent.

Guidance

  • Identify the code in packages/@n8n/client-oauth2/src/client-oauth2.ts that swaps in the custom httpsAgent when ignoreSSLIssues=true and consider modifying it to use the global HTTPS agent instead.
  • Verify that the global HTTPS agent is properly configured to route requests through the proxy when ignoreSSLIssues=true.
  • Test the modified code with the provided reproduction steps to ensure that the request succeeds and the proxy receives the CONNECT request.
  • Consider adding additional logging or debugging statements to understand the request flow and identify any potential issues.

Example

// packages/@n8n/client-oauth2/src/client-oauth2.ts
const httpsAgent = ignoreSSLIssues
  ? new https.Agent({ rejectUnauthorized: false }) // custom agent
  : globalHttpsAgent; // use global HTTPS agent

becomes

// packages/@n8n/client-oauth2/src/client-oauth2.ts
const httpsAgent = globalHttpsAgent; // use global HTTPS agent
httpsAgent.options.rejectUnauthorized = !ignoreSSLIssues; // set rejectUnauthorized based on ignoreSSLIssues

Notes

The provided reproduction steps and code snippets suggest that the issue is specific to the @n8n/client-oauth2 package and its interaction with the global HTTPS agent. However, without further information about the globalHttpsAgent and its configuration, it is difficult to provide a complete solution.

Recommendation

Apply a workaround by modifying the @n8n/client-oauth2 package to use the global HTTPS agent with rejectUnauthorized: false when ignoreSSLIssues=true, as this is the most direct way to address the issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Enabling Ignore SSL Issues should disable TLS verification without changing the proxy routing path.

#api#inference speed#output truncation#response parsing#generation error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING