fix(gateway): prevent auth bypass when behind unconfigured reverse proxy (#1795)

mirror of https://github.com/farcasclaudiu/openclaw.git synced 2026-06-29 15:01:48 +03:00

* fix(gateway): prevent auth bypass when behind unconfigured reverse proxy

When proxy headers (X-Forwarded-For, X-Real-IP) are present but
gateway.trustedProxies is not configured, the gateway now treats
connections as non-local. This prevents a scenario where all proxied
requests appear to come from localhost and receive automatic trust.

Previously, running behind nginx/Caddy without configuring trustedProxies
would cause isLocalClient=true for all external connections, potentially
bypassing authentication and auto-approving device pairing.

The gateway now logs a warning when this condition is detected, guiding
operators to configure trustedProxies for proper client IP detection.

Also adds documentation for reverse proxy security configuration.

* fix: harden reverse proxy auth (#1795) (thanks @orlyjamie)

---------

Co-authored-by: orlyjamie <orlyjamie@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>

This commit is contained in:

Jamieson O'Reilly

2026-01-26 02:08:03 +11:00

committed by

GitHub

parent 1c606fdb57

commit 6aec34bc60

6 changed files with 133 additions and 6 deletions

									
										CHANGELOG.md
									
		+3
		
												View File
												
				@@ -7,6 +7,9 @@ Docs: https://docs.clawd.bot

				### Changes

				- TBD.

				### Fixes

				- Gateway: harden reverse proxy handling for local-client detection and unauthenticated proxied connects. (#1795) Thanks @orlyjamie.

				## 2026.1.24-2

				### Fixes