github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-08 01:21:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(gateway): require loopback proxy IP for trusted-proxy + bind=loopback (#22082)

Browse Source 
Merged via /review-pr -> /prepare-pr -> /merge-pr.

Prepared head SHA: 6ff3ca9b5d
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
This commit is contained in:
Mariano
2026-02-20 18:03:53 +00:00
committed by GitHub
parent 9c5249714d
commit 094dbdaf2b
4 changed files with 67 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/gateway/server-runtime-config.ts
View File

@@ -11,7 +11,12 @@ import {
} from "./auth.js";
import { normalizeControlUiBasePath } from "./control-ui-shared.js";
import { resolveHooksConfig } from "./hooks.js";
import { isLoopbackHost, isValidIPv4, resolveGatewayBindHost } from "./net.js";
import {
isLoopbackHost,
isTrustedProxyAddress,
isValidIPv4,
resolveGatewayBindHost,
} from "./net.js";
import { mergeGatewayTailscaleConfig } from "./startup-auth.js";
export type GatewayRuntimeConfig = {
@@ -122,6 +127,16 @@ export async function resolveGatewayRuntimeConfig(params: {
"gateway auth mode=trusted-proxy requires gateway.trustedProxies to be configured with at least one proxy IP",
);
}
if (isLoopbackHost(bindHost)) {
const hasLoopbackTrustedProxy =
isTrustedProxyAddress("127.0.0.1", trustedProxies) ||
isTrustedProxyAddress("::1", trustedProxies);
if (!hasLoopbackTrustedProxy) {
throw new Error(
"gateway auth mode=trusted-proxy with bind=loopback requires gateway.trustedProxies to include 127.0.0.1, ::1, or a loopback CIDR",
);
}
}
}
return {