N8N WhatsApp-Based EvolutionAPI,Google Calendar and MCP Appointment System Security
Budget: $10 – $30 USD
Hello!
I hope everything is well! I need your help with an important security feature in our WhatsApp-based Evolution API and Google Calendar and MCP Server scheduling system.
Problem context:
We currently have an N8N workflow using Google Calendar that connects to the Evolution API to manage medical appointments via WhatsApp. However, there is a critical vulnerability: any user can modify other users' appointments, which must not happen.
Security requirements:
We need to implement phone number–based access control with the following rules:
Main rule:
Each user can only view and modify their own appointments.
The Owner and the Secretary can view and reschedule all appointments.
Necessary validations:
Authentication by number:
• Capture the WhatsApp number (RemoteJID) of the message sender
• Validate if this number is registered before providing access to the SCHEDULE and existing Appointments
Data isolation:
• When listing appointments: return ONLY appointments belonging to the number making the request
• When modifying appointments: validate whether the appointment belongs to the number (OR if the requester is the OWNER, Manager, etc.) before allowing changes
• When canceling appointments: same — check ownership before processing
Authorization flow:
WhatsApp User (+55 11 98765-4321)
• Evolution API (captures number)
• N8N Workflow (validates number)
• Database (filters by owner number)
• Returns/Modifies ONLY that user's data
Use cases:
Allowed scenario:
User A (11 98765-4321) books an appointment at 2:00 PM
User A sends: "I want to reschedule to 4:00 PM"
• System validates: number matches appointment owner
• ALLOWS modification
Blocked scenario:
User A (11 98765-4321) books an appointment at 2:00 PM
User B (11 91234-5678) sends: "I want to reschedule to 4:00 PM"
• System validates: number does NOT match
• BLOCKS modification
• Returns: "You can only modify your own appointments."
I'm using the MCP Server Trigger,
So the analogy is:
It's like a building where everyone uses the same elevator, but each person can only press the button for their own floor.
Only the cleaning lady and the owner can press all the floors.
I hope everything is well! I need your help with an important security feature in our WhatsApp-based Evolution API and Google Calendar and MCP Server scheduling system.
Problem context:
We currently have an N8N workflow using Google Calendar that connects to the Evolution API to manage medical appointments via WhatsApp. However, there is a critical vulnerability: any user can modify other users' appointments, which must not happen.
Security requirements:
We need to implement phone number–based access control with the following rules:
Main rule:
Each user can only view and modify their own appointments.
The Owner and the Secretary can view and reschedule all appointments.
Necessary validations:
Authentication by number:
• Capture the WhatsApp number (RemoteJID) of the message sender
• Validate if this number is registered before providing access to the SCHEDULE and existing Appointments
Data isolation:
• When listing appointments: return ONLY appointments belonging to the number making the request
• When modifying appointments: validate whether the appointment belongs to the number (OR if the requester is the OWNER, Manager, etc.) before allowing changes
• When canceling appointments: same — check ownership before processing
Authorization flow:
WhatsApp User (+55 11 98765-4321)
• Evolution API (captures number)
• N8N Workflow (validates number)
• Database (filters by owner number)
• Returns/Modifies ONLY that user's data
Use cases:
Allowed scenario:
User A (11 98765-4321) books an appointment at 2:00 PM
User A sends: "I want to reschedule to 4:00 PM"
• System validates: number matches appointment owner
• ALLOWS modification
Blocked scenario:
User A (11 98765-4321) books an appointment at 2:00 PM
User B (11 91234-5678) sends: "I want to reschedule to 4:00 PM"
• System validates: number does NOT match
• BLOCKS modification
• Returns: "You can only modify your own appointments."
I'm using the MCP Server Trigger,
So the analogy is:
It's like a building where everyone uses the same elevator, but each person can only press the button for their own floor.
Only the cleaning lady and the owner can press all the floors.