> For the complete documentation index, see [llms.txt](https://docs.n8n.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.n8n.io/deploy/host-n8n/configure-n8n/basic-configuration/use-environment-variables/security.md).

# Security

{% hint style="info" %}
**File-based configuration**

You can add `_FILE` to individual variables to provide their configuration in a separate file. Refer to [Keeping sensitive data in separate files](/deploy/host-n8n/configure-n8n/basic-configuration.md#keeping-sensitive-data-in-separate-files) for more details.
{% endhint %}

| Variable                                     | Type                                 | Default | Description                                                                                                                                                                                                                                                                                                                                                                   |
| -------------------------------------------- | ------------------------------------ | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `N8N_BLOCK_ENV_ACCESS_IN_NODE`               | Boolean                              | `false` | Whether to allow users to access environment variables in expressions and the Code node (false) or not (true).                                                                                                                                                                                                                                                                |
| `N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES`         | Boolean                              | `true`  | Set to `true` to block access to all files in the `.n8n` directory and user defined configuration files.                                                                                                                                                                                                                                                                      |
| `N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS`      | Boolean                              | `false` | Set to `true` to try to set 0600 permissions for the settings file, giving only the owner read and write access.                                                                                                                                                                                                                                                              |
| `N8N_RESTRICT_FILE_ACCESS_TO`                | String                               |         | Limits access to files in these directories. Provide multiple files as a semicolon-separated list ("`;`").                                                                                                                                                                                                                                                                    |
| `N8N_SECURITY_AUDIT_DAYS_ABANDONED_WORKFLOW` | Number                               | 90      | Number of days to consider a workflow abandoned if it's not executed.                                                                                                                                                                                                                                                                                                         |
| `N8N_CONTENT_SECURITY_POLICY`                | String                               | `{}`    | Set [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) headers as [helmet.js](https://helmetjs.github.io/#content-security-policy) nested directives object. For example, `{ "frame-ancestors": ["http://localhost:3000"] }`                                                                                                                    |
| `N8N_SECURE_COOKIE`                          | Boolean                              | `true`  | Ensures that cookies are only sent over HTTPS, enhancing security.                                                                                                                                                                                                                                                                                                            |
| `N8N_SAMESITE_COOKIE`                        | Enum string: `strict`, `lax`, `none` | `lax`   | <p>Controls cross-site cookie behavior (<a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite">learn more</a>):</p><ul><li><code>strict</code>: Sent only for first-party requests.</li><li><code>lax</code> (default): Sent with top-level navigation requests.</li><li><code>none</code>: Sent in all contexts (requires HTTPS).</li></ul> |
| `N8N_GIT_NODE_DISABLE_BARE_REPOS`            | Boolean                              | `false` | Set to `true` to prevent the [Git node](/integrations/builtin/core-nodes/n8n-nodes-base.git.md) from working with bare repositories, enhancing security.                                                                                                                                                                                                                      |
| `N8N_GIT_NODE_ENABLE_HOOKS`                  | Boolean                              | `false` | Set to `true` to allow the [Git node](/integrations/builtin/core-nodes/n8n-nodes-base.git.md) to execute Git hooks.                                                                                                                                                                                                                                                           |

## Security policy using environment variables <a href="#security-policy-using-environment-variables" id="security-policy-using-environment-variables"></a>

Set `N8N_SECURITY_POLICY_MANAGED_BY_ENV` to `true` to manage the security policy from environment variables. See [Manage instance settings using environment variables](/deploy/host-n8n/configure-n8n/manage-settings-using-environment-variables.md) for how the activation pattern works.

| Variable                                | Type    | Default | Description                                                                                                                                                                         |
| --------------------------------------- | ------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `N8N_SECURITY_POLICY_MANAGED_BY_ENV`    | Boolean | `false` | Set to `true` to manage the security policy from environment variables. When `true`, n8n applies the security policy variables on every startup and locks the matching UI controls. |
| `N8N_MFA_ENFORCED_ENABLED`              | Boolean | `false` | Whether to enforce two-factor authentication for all users (`true`) or not (`false`).                                                                                               |
| `N8N_PERSONAL_SPACE_PUBLISHING_ENABLED` | Boolean | `true`  | Whether users can publish from their personal space (`true`) or not (`false`).                                                                                                      |
| `N8N_PERSONAL_SPACE_SHARING_ENABLED`    | Boolean | `true`  | Whether users can share resources from their personal space (`true`) or not (`false`).                                                                                              |