mirror of https://github.com/openclaw/openclaw.git synced 2026-02-09 05:19:32 +08:00

Files

Gustavo Madeira Santana a13ff55bd9 Security: Prevent gateway credential exfiltration via URL override (#9179 )

* Gateway: require explicit auth for url overrides

* Gateway: scope credential blocking to non-local URLs only

Address review feedback: the previous fix blocked credential fallback for
ALL URL overrides, which was overly strict and could break workflows that
use --url to switch between loopback/tailnet without passing credentials.

Now credential fallback is only blocked for non-local URLs (public IPs,
external hostnames). Local addresses (127.0.0.1, localhost, private IPs
like 192.168.x.x, 10.x.x.x, tailnet 100.x.x.x) still get credential
fallback as before.

This maintains the security fix (preventing credential exfiltration to
attacker-controlled URLs) while preserving backward compatibility for
legitimate local URL overrides.

* Security: require explicit credentials for gateway url overrides (#8113) (thanks @victormier)

* Gateway: reuse explicit auth helper for url overrides (#8113) (thanks @victormier)

* Tests: format gateway chat test (#8113) (thanks @victormier)

* Tests: require explicit auth for gateway url overrides (#8113) (thanks @victormier)

---------

Co-authored-by: Victor Mier <victormier@gmail.com>

2026-02-04 18:59:44 -05:00

1.8 KiB

Raw Permalink Blame History

summary, read_when, title

summary

read_when

title

CLI reference for `openclaw devices` (device pairing + token rotation/revocation)

You are approving device pairing requests

You need to rotate or revoke device tokens

devices

`openclaw devices`

Manage device pairing requests and device-scoped tokens.

Commands

`openclaw devices list`

List pending pairing requests and paired devices.

openclaw devices list
openclaw devices list --json

`openclaw devices approve <requestId>`

Approve a pending device pairing request.

openclaw devices approve <requestId>

`openclaw devices reject <requestId>`

Reject a pending device pairing request.

openclaw devices reject <requestId>

`openclaw devices rotate --device <id> --role <role> [--scope <scope...>]`

Rotate a device token for a specific role (optionally updating scopes).

openclaw devices rotate --device <deviceId> --role operator --scope operator.read --scope operator.write

`openclaw devices revoke --device <id> --role <role>`

Revoke a device token for a specific role.

openclaw devices revoke --device <deviceId> --role node

Common options

--url <url>: Gateway WebSocket URL (defaults to gateway.remote.url when configured).
--token <token>: Gateway token (if required).
--password <password>: Gateway password (password auth).
--timeout <ms>: RPC timeout.
--json: JSON output (recommended for scripting).

Note: when you set --url, the CLI does not fall back to config or environment credentials. Pass --token or --password explicitly. Missing explicit credentials is an error.

Notes

Token rotation returns a new token (sensitive). Treat it like a secret.
These commands require operator.pairing (or operator.admin) scope.

1.8 KiB Raw Permalink Blame History

openclaw devices

Commands

openclaw devices list

openclaw devices approve <requestId>

openclaw devices reject <requestId>

openclaw devices rotate --device <id> --role <role> [--scope <scope...>]

openclaw devices revoke --device <id> --role <role>