Issue Station
Sign In
Tools hereToolbox

n8n - ✅(Solved) Fix WooCommerce node (and others) send bare "n8n" User-Agent string, causing requests to be blocked by WAFs [2 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
n8n-io/n8n#28280•Fetched 2026-04-10 03:44:23
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
0
Author
pmboomerpmboomer
Participants
n8n-assistant[bot]n8n-assistant[bot]pmboomerpmboomer
Timeline (top)
commented ×1labeled ×1mentioned ×1subscribed ×1

Error Message

  • error: all

Root Cause

  1. Create a workflow using any native n8n node that makes outbound HTTP requests (e.g. WooCommerce)
  2. Target a site protected by a WAF with UA string validation (e.g. SiteDistrict firewall)
  3. Execute the workflow
  4. Observe requests blocked with HTTP 403 and block reason: "Bad User-Agent"
  5. Note: the issue also affects credential testing — the WooCommerce credential test fails with "resource could not be found" because the WAF blocks the test request before it reaches the server

Fix Action

Fix / Workaround

n8n sends a bare n8n string as its User-Agent header on outbound HTTP requests. This is not a valid UA string and causes requests to be blocked by Web Application Firewalls (WAFs) that enforce UA string standards. Affected sites return 403 errors with the reason "Bad User-Agent," breaking integrations completely. The only workaround is to abandon native nodes and rebuild them as HTTP Request nodes with a manually set User-Agent header.

PR fix notes

PR #28360: fix(core): Use RFC-style default outbound User-Agent

Description (problem / solution / changelog)

Summary

  • replace the default outbound User-Agent from bare n8n to a WAF-friendly RFC-style token (Mozilla/5.0 (compatible; n8n/<version>; +https://n8n.io/))
  • add a dedicated utility to resolve n8n version for outbound headers while preserving explicit user overrides
  • add unit and integration tests covering user-agent generation and runtime request behavior
  • implemented from a Cursor-assisted workflow

Related Linear tickets, Github issues, and Community forum posts

Test plan

  • cd packages/core && pnpm exec jest src/execution-engine/node-execution-context/utils/__tests__/outbound-user-agent.test.ts src/execution-engine/node-execution-context/utils/__tests__/outbound-user-agent.integration.test.ts src/execution-engine/node-execution-context/utils/__tests__/request-helper-functions.test.ts --no-cache

Review / Merge checklist

  • I have seen this code, I have run this code, and I take responsibility for this code.
  • PR title and summary are descriptive.
  • Docs updated or follow-up ticket created.
  • Tests included.
  • PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if needed)

Changed files

  • packages/core/src/execution-engine/node-execution-context/utils/__tests__/outbound-user-agent.integration.test.ts (added, +33/-0)
  • packages/core/src/execution-engine/node-execution-context/utils/__tests__/outbound-user-agent.test.ts (added, +17/-0)
  • packages/core/src/execution-engine/node-execution-context/utils/__tests__/request-helper-functions.test.ts (modified, +4/-21)
  • packages/core/src/execution-engine/node-execution-context/utils/outbound-user-agent.ts (added, +31/-0)
  • packages/core/src/execution-engine/node-execution-context/utils/request-helper-functions.ts (modified, +2/-1)
  • packages/nodes-base/credentials/DropcontactApi.credentials.ts (modified, +0/-1)
  • packages/nodes-base/credentials/PerplexityApi.credentials.ts (modified, +0/-1)
  • packages/nodes-base/credentials/RundeckApi.credentials.ts (modified, +0/-1)
  • packages/nodes-base/nodes/ApiTemplateIo/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Bitwarden/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Bubble/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Coda/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Github/GenericFunctions.ts (modified, +0/-3)
  • packages/nodes-base/nodes/Github/__tests__/GenericFunctions.test.ts (modified, +0/-2)
  • packages/nodes-base/nodes/Github/__tests__/node/Github.node.test.ts (modified, +0/-1)
  • packages/nodes-base/nodes/GoToWebinar/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/HaloPSA/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Odoo/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Odoo/Odoo.node.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Onfleet/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Onfleet/Onfleet.node.ts (modified, +0/-1)
  • packages/nodes-base/nodes/OpenThesaurus/GenericFunctions.ts (modified, +0/-3)
  • packages/nodes-base/nodes/Plivo/GenericFunctions.ts (modified, +0/-3)
  • packages/nodes-base/nodes/QuickBase/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/QuickBooks/GenericFunctions.ts (modified, +0/-3)
  • packages/nodes-base/nodes/Raindrop/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Reddit/GenericFunctions.ts (modified, +0/-3)
  • packages/nodes-base/nodes/Spotify/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Spotify/__tests__/GenericFunctions.test.ts (modified, +0/-1)
  • packages/nodes-base/nodes/UrlScanIo/descriptions/ScanDescription.ts (modified, +1/-1)
  • packages/nodes-base/nodes/Wise/GenericFunctions.ts (modified, +0/-1)
  • packages/nodes-base/nodes/Wordpress/GenericFunctions.ts (modified, +0/-1)

PR #28477: fix(core): update default User-Agent to include version and support N…

Description (problem / solution / changelog)

…8N_USER_AGENT override #28280

Summary

This PR resolves the issue where n8n sends a bare n8n string as the default User-Agent for outbound HTTP requests. This format is often flagged by Web Application Firewalls (WAFs) as a "Bad User-Agent," leading to 403 Forbidden errors for nodes such as WooCommerce, WordPress, and GitHub.

Changes Implemented:

  • RFC-Compliant Default: Modified @n8n/core to set the default User-Agent to n8n/${version} (e.g., n8n/1.23.0).
  • Environment Variable Override: Introduced N8N_USER_AGENT, allowing users to provide a custom string (e.g., a Chrome/Mozilla identity) for environments with extremely strict security policies.
  • Legacy & Modern Support: Applied the logic to both convertN8nRequestToAxios and proxyRequestToAxios within request-helper-functions.ts.
  • Unit Tests: Updated request-helper-functions.test.ts to verify both the new default versioning and the environment variable override.

How to test:

  1. Run n8n locally: pnpm dev.
  2. Use a WooCommerce node (or an HTTP Request node) and point it to a local listener (e.g., nc -l 8080).
  3. Execute the node and verify the User-Agent header in the terminal output.
  4. Restart n8n with export N8N_USER_AGENT="CustomAgent/1.0" and verify the header updates accordingly.

Related Linear tickets, Github issues, and Community forum posts

  • Fixes #28280
  • Internal Linear: GHC-7673

Review / Merge checklist

  • I have seen this code, I have run this code, and I take responsibility for this code.
  • PR title and summary are descriptive.
  • Docs updated (Will create follow-up for the new N8N_USER_AGENT variable).
  • Tests included.

Changed files

  • packages/core/src/execution-engine/node-execution-context/utils/request-helper-functions.ts (modified, +13/-1)
RAW_BUFFERClick to expand / collapse

Bug Description

n8n sends a bare n8n string as its User-Agent header on outbound HTTP requests. This is not a valid UA string and causes requests to be blocked by Web Application Firewalls (WAFs) that enforce UA string standards. Affected sites return 403 errors with the reason "Bad User-Agent," breaking integrations completely. The only workaround is to abandon native nodes and rebuild them as HTTP Request nodes with a manually set User-Agent header.

<img width="1681" height="523" alt="Image" src="https://github.com/user-attachments/assets/8c528d6b-91e6-4e04-9b5b-08d70e8f6173" />

To Reproduce

  1. Create a workflow using any native n8n node that makes outbound HTTP requests (e.g. WooCommerce)
  2. Target a site protected by a WAF with UA string validation (e.g. SiteDistrict firewall)
  3. Execute the workflow
  4. Observe requests blocked with HTTP 403 and block reason: "Bad User-Agent"
  5. Note: the issue also affects credential testing — the WooCommerce credential test fails with "resource could not be found" because the WAF blocks the test request before it reaches the server
<img width="1776" height="1420" alt="Image" src="https://github.com/user-attachments/assets/c62ed24d-d619-413a-a307-178a062d3837" />

I've also used https://wizardacademy.org/wp-json/wc/v3 and https://wizardacademy.org/wp-json/wc/v3/ as the URL

Expected behavior

n8n should send a properly formatted User-Agent string that identifies the application, version, and vendor per RFC convention, for example: Mozilla/5.0 (compatible; n8n/1.0; +https://n8n.io/) This would allow outbound requests to pass WAF validation and reach their target servers without being blocked.

Debug Info

I cannot access the debug because I cannot save the node due to the inability to connect to WooCommerce.

Debug info

core

  • n8nVersion: 1.123.27
  • platform: docker (cloud)
  • nodeJsVersion: 24.13.1
  • nodeEnv: production
  • database: sqlite
  • executionMode: regular
  • concurrency: 5
  • license: enterprise (sandbox)
  • consumerId: 00000000-0000-0000-0000-000000000000

storage

  • success: all
  • error: all
  • progress: false
  • manual: true
  • binaryMode: filesystem

pruning

  • enabled: true
  • maxAge: 168 hours
  • maxCount: 2500 executions

client

  • userAgent: mozilla/5.0 (macintosh; intel mac os x 10_15_7) applewebkit/537.36 (khtml, like gecko) chrome/146.0.0.0 safari/537.36
  • isTouchDevice: false

Generated at: 2026-04-10T02:00:28.232Z

Operating System

unknown

n8n Version

1.123.27

Node.js Version

unknown

Database

SQLite (default)

Execution mode

main (default)

Hosting

n8n cloud

extent analysis

TL;DR

  • Set a valid User-Agent header in n8n's outbound HTTP requests to prevent blocking by Web Application Firewalls (WAFs).

Guidance

  • Identify the native n8n nodes that make outbound HTTP requests and consider rebuilding them as HTTP Request nodes with a manually set User-Agent header.
  • Use a properly formatted User-Agent string that identifies the application, version, and vendor per RFC convention, such as Mozilla/5.0 (compatible; n8n/1.0; +https://n8n.io/).
  • Test the workaround by executing the modified workflow and verifying that requests are no longer blocked with HTTP 403 errors.
  • Consider updating n8n to a version that includes a fix for this issue, if available.

Example

  • No code snippet is provided, as the issue does not imply a specific code change.

Notes

  • The provided workaround may not be feasible for all users, especially those with complex workflows or limited technical expertise.
  • The issue may be resolved in a future version of n8n, but the current version (1.123.27) is affected.

Recommendation

  • Apply workaround: Set a valid User-Agent header in n8n's outbound HTTP requests to prevent blocking by WAFs, as this is the most straightforward solution to the problem.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

n8n should send a properly formatted User-Agent string that identifies the application, version, and vendor per RFC convention, for example: Mozilla/5.0 (compatible; n8n/1.0; +https://n8n.io/) This would allow outbound requests to pass WAF validation and reach their target servers without being blocked.

#authentication setup#request error#file not found#serialization error#model compatibility

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING