github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 07:37:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(gateway): require loopback proxy IP for trusted-proxy + bind=loopback (#22082)

Browse Source 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 6ff3ca9b5d
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
This commit is contained in:
Mariano
2026-02-20 18:03:53 +00:00
committed by GitHub
parent 9c5249714d
commit 094dbdaf2b
4 changed files with 67 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
src/gateway/server-runtime-config.test.ts
View File

@@ -51,6 +51,27 @@ describe("resolveGatewayRuntimeConfig", () => {
expect(result.bindHost).toBe("127.0.0.1");
});
it("should allow loopback trusted-proxy when trustedProxies includes ::1", async () => {
const cfg = {
gateway: {
bind: "loopback" as const,
auth: {
mode: "trusted-proxy" as const,
trustedProxy: {
userHeader: "x-forwarded-user",
},
},
trustedProxies: ["::1"],
},
};
const result = await resolveGatewayRuntimeConfig({
cfg,
port: 18789,
});
expect(result.bindHost).toBe("127.0.0.1");
});
it("should reject loopback trusted-proxy without trustedProxies configured", async () => {
const cfg = {
gateway: {
@@ -75,6 +96,30 @@ describe("resolveGatewayRuntimeConfig", () => {
);
});
it("should reject loopback trusted-proxy when trustedProxies has no loopback address", async () => {
const cfg = {
gateway: {
bind: "loopback" as const,
auth: {
mode: "trusted-proxy" as const,
trustedProxy: {
userHeader: "x-forwarded-user",
},
},
trustedProxies: ["10.0.0.1"],
},
};
await expect(
resolveGatewayRuntimeConfig({
cfg,
port: 18789,
}),
).rejects.toThrow(
"gateway auth mode=trusted-proxy with bind=loopback requires gateway.trustedProxies to include 127.0.0.1, ::1, or a loopback CIDR",
);
});
it("should reject trusted-proxy without trustedProxies configured", async () => {
const cfg = {
gateway: {