n8n-nodes-rawform

Two n8n community nodes — Raw Form Trigger and Raw Form Response — that
serve fully author-controlled, unsanitised HTML as multi-page web forms,
driven by n8n's native durable wait/resume so a workflow can park on a form page
for seconds or days.

They replicate the mechanism of stock n8n's Form Trigger / Form nodes.
The one product difference:

The page markup is a raw HTML string you supply — your own <head>,
<style>, <script>, arbitrary <form>/<input>, any framework (SurveyJS,
a React bundle, Tailwind via CDN, …). Stock n8n runs custom form HTML through
an allow-list that strips form, input, button, select, textarea,
script, style, head, html, body, so custom HTML there is
decoration-only. Here nothing is stripped.

⚠️ Do not install on a multi-tenant n8n

Installing a node that executes workflow-author-supplied HTML/JS is only safe
when every workflow author is fully trusted.

Every served page runs under a null-origin sandbox CSP (below). That stops
the page abusing the viewer's n8n session — it does not stop the author's
JavaScript making arbitrary outbound fetches: exfiltrating submitted form
data to a third party, or beaconing / port-scanning from the n8n host's network
position (significant if n8n sits inside a corporate perimeter).

Do not install n8n-nodes-rawform on a multi-tenant n8n where workflow authors
are not fully trusted. On a single-tenant / personal / trusted-team instance it
is no more dangerous than a Code node.

Install

Community Nodes UI (n8n Settings → Community Nodes → Install):

n8n-nodes-rawform

or from a shell on the n8n host / image:

npm i n8n-nodes-rawform

Restart n8n. Two nodes appear: Raw Form Trigger (a trigger) and Raw Form
Response (an action, "Next Page" or "Ending").

Supported n8n

2.36.x (SUPPORTED_N8N_RANGE in
nodes/shared/version.ts).

The GET-render step of the wait/resume mechanism rests on an internal n8n
implementation detail (WebhookHelpers.executeWebhook()'s
early-return-when-no-workflowData). It is not covered by any n8n public API
contract, so the supported range is verified per-version by our E2E suite
(e2e/) and widened only after a green run on the new version — never on
a version number alone. If you run a newer n8n and it works, open an issue with
your version and we'll add it to the matrix.

How a flow is built

Raw Form Trigger ──▶ (your workflow) ──▶ Raw Form Response (Next Page) ──▶ … ──▶ Raw Form Response (Ending)
   GET  renders page 1                      parks, GET renders the next page          renders the final page
   POST starts the run                      POST resumes the run                      and completes the run

• The Trigger GET serves page 1; its POST starts the execution.
• Each Next Page Response node parks the execution (putExecutionToWait) and,
  on resume, its GET renders that page and its POST resumes the run with the
  submitted data.
• The Ending Response node renders a final page (or a redirect, or a binary
  download). Its resume GET both shows the page and completes the execution,
  so any nodes wired after it run — this works on the poll path and even if the
  visitor reopens the link days later.

Page transitions use a 303 redirect to the signed resume URL, sent in
milliseconds before the wait — the browser then polls that URL (200 = next
page ready, 409 = still running) until the flow advances. Nothing depends on a
held HTTP connection surviving across the wait, so a reverse proxy with a short
idle timeout in front of n8n is fine.

Output shape

Both nodes output one item per submission:

{
  "json": {
    "data": {                     // ← your fields live under json.data (not flat)
      "email": "ada@example.com",
      "topics": ["ml", "hardware"] // repeated name= → array
    },
    "submittedAt": "2026-08-30T14:12:03.000+01:00", // workflow timezone by default
    "formMode": "production"       // or "test" for a manual run
  },
  "binary": {                      // present only if the form uploaded files
    "resume": { /* n8n binary data */ }
  }
}

• Fields are nested under json.data (deviation from stock's flat shape — it
  avoids collisions with submittedAt / formMode).
• A repeated name= becomes an array; a single one stays a string.
• File <input type="file"> values become n8n binary properties on the
  item (named after the field; suffixed _2, _3, … for multiples).
• submittedAt is ISO-8601 in the workflow timezone unless you turn off
  Use Workflow Timezone on the trigger (then UTC).

Auth

On the Trigger, Authentication:

• None (default) — the webhook is as exposed as any n8n webhook.
• Basic Auth — an httpBasicAuth credential; the browser gets a 401 +
  WWW-Authenticate until it sends valid credentials.

There is no n8n User Auth option — n8n's form-user OAuth path is not
reachable from a community node. Put an authenticating proxy in front if you need
SSO.

Sandbox CSP (always on, no opt-out)

Every page is served with:

Content-Security-Policy: sandbox allow-scripts allow-forms allow-modals allow-popups allow-downloads

This is a null origin: no cookies, and the page's JS cannot reach n8n's
authenticated API as the viewer. There is deliberately no node-level opt-out
(stock has N8N_INSECURE_DISABLE_FORM_HTML_SANDBOX at the instance level if an
operator truly needs same-origin). Your HTML is not otherwise sanitised —
your form is responsible for its own XSS posture within its own null origin.

⚠️ Client-side {{ }} template engines are not supported in v1

Your Page HTML / Ending HTML is always run through n8n's expression
evaluator first — that is how {{ $json.data.name }} works. n8n resolves
every {{ … }} in the document, so a page built with a template engine that
also uses {{ }} — Vue, Angular, Handlebars, Mustache — is mangled or throws
before it ever reaches the browser.

Use one of:

• %%…%% placeholder substitution for the values the node injects
  (%%N8N_SUBMIT_URL%%, %%N8N_TEST_MODE%%) — these are replaced after the
  expression pass and never collide with {{ }}.
• A JS-config framework that does not use {{ }} in markup — e.g. SurveyJS
  (schema is a JS object), a hand-written React bundle using JSX / h(), htmx,
  Alpine (x-text), etc.

There is deliberately no "don't evaluate expressions" toggle in v1.

Recommend: set Limit Wait Time on public / high-volume forms

With Limit Wait Time off, an abandoned form parks forever and the
execution row stays waiting indefinitely (same as the stock Wait node). On a
public or high-volume form that piles up.

Turn Limit Wait Time on (Next Page node) with a Max Wait — at the cap n8n
disables the parked node and resumes the workflow, passing the previous page's
item through the node's single output unchanged. Detect the abandoned journey
downstream (e.g. an IF on submittedAt / a marker field) — there is no
separate "timed out" output.

Worked examples

Each block is a complete workflow you can paste into n8n
(Workflows → ⋯ → Import from File won't take inline JSON; use
Import from URL or just recreate the three nodes). Node parameters are shown;
wire them Trigger → Response(s) on the main connector.

(a) Plain two-page form

Page 1 collects a name, page 2 confirms, an ending thanks the visitor.

Raw Form Trigger — Page HTML:

<!doctype html><meta charset="utf-8"><title>Step 1</title>
<h1>Your details</h1>
<form>
  <label>Name <input name="name" required></label>
  <label>Email <input name="email" type="email" required></label>
  <button type="submit">Next</button>
</form>

Raw Form Response — Page Type: Next Page, Page HTML:

<!doctype html><meta charset="utf-8"><title>Step 2</title>
<h1>Anything to add?</h1>
<form>
  <label>Notes <textarea name="notes"></textarea></label>
  <button type="submit">Finish</button>
</form>

Raw Form Response — Page Type: Ending, Respond With: Custom HTML,
Ending HTML:

<!doctype html><meta charset="utf-8"><title>Thanks</title>
<h1>Thanks, {{ $json.data.name }}</h1>
<p>We'll be in touch at {{ $json.data.email }}.</p>

A single <form> with no n8nRawForm reference is auto-wired: the runtime
sets method/action, intercepts submit, and drives the poll for you.

(b) SurveyJS page — manual submit via window.n8nRawForm.submit

When your page has no plain <form> (a JS widget owns the UI), call the
injected API yourself. The runtime always exposes:

window.n8nRawForm.submit(formElementOrFormDataOrPlainObject) // → Promise<void>

Raw Form Response — Next Page, Page HTML:

<!doctype html><meta charset="utf-8"><title>Survey</title>
<link href="https://unpkg.com/survey-core/survey-core.min.css" rel="stylesheet">
<div id="survey"></div>
<script src="https://unpkg.com/survey-core/survey.core.min.js"></script>
<script src="https://unpkg.com/survey-js-ui/survey-js-ui.min.js"></script>
<script>
  const survey = new Survey.Model({
    elements: [
      { type: 'rating', name: 'nps', title: 'How likely are you to recommend us?' },
      { type: 'comment', name: 'why', title: 'Why?' }
    ]
  })
  survey.onComplete.add((s) => {
    // hand the flat answers straight to n8n; resolves once the run has resumed
    window.n8nRawForm.submit(s.data)
  })
  document.addEventListener('DOMContentLoaded', () =>
    survey.render(document.getElementById('survey')))
</script>

The answers arrive as {{ $json.data.nps }}, {{ $json.data.why }}.
window.n8nRawForm.testMode is true under a manual/test execution if you want
to branch on it. External CDN scripts require the sandbox's allow-scripts
(always on) and network egress from the browser.

(c) Branching with a Switch

Route to a different page 3 based on a page-2 answer.

Trigger ─▶ Response "Page 2" ─▶ Switch ─▶ Response "Page 3 — team"
                                      └──▶ Response "Page 3 — solo"
                                                     both ─▶ Response "Ending"

Switch (n8n core) — Mode: Expression, Number of Outputs: 2, output:

={{ $json.data.plan === "team" ? 0 : 1 }}

Each downstream Raw Form Response ("Next Page") renders its own HTML and
waits; both feed one Ending node. The resume URL is the same for every hop of
a given execution, so branching needs nothing special — just wire the graph.

(d) Days-long park with an emailed resume link

Send the visitor away and let them come back via a link in their inbox. The
signed resume URL is {{ $execution.resumeUrl }} — valid for the life of the
parked execution (turn on Limit Wait Time to bound it).

Trigger ─▶ Send Email ─▶ Raw Form Response "Continue later" (Next Page)

Send Email (n8n core) — Text:

Hi {{ $json.data.name }},

Pick up where you left off any time in the next 7 days:
{{ $execution.resumeUrl }}

Raw Form Response — Next Page, Limit Wait Time: on, Max Wait:
{{ $now.plus(7, 'days') }}, Page HTML: a simple "we've emailed you a link to
continue" holding page. When they click the link days later, this node's GET
renders the real next page and the flow resumes exactly where it parked — through
an n8n restart, too.

Development

This repo uses bun.

bun install
bun run typecheck
bun run test                  # vitest unit suite — use `bun run test`, not `bun test`
bun run build                 # tsc + copy the icon svgs → dist/
bun run test:e2e              # 1 dockerised n8n, regular/production, all scenarios
bun run test:e2e -- --matrix  # full grid: {regular,queue} × {production,manual}

bun test invokes bun's own test runner and reports spurious failures — the
unit suite runs under vitest via bun run test.

The E2E harness (e2e/README.md) is the load-bearing check —
it stands up a real dockerised n8n, loads the built dist/ as a custom
extension, and drives the whole wait/resume mechanism over real HTTP, because
that mechanism rests on n8n internals no unit test can reach. It needs Docker
and the pinned image (docker pull docker.n8n.io/n8nio/n8n:2.36.8).

Licence

MIT