github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-08 13:01:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: silence unused hook token url param (#9436)

Browse Source 
* fix: Gateway authentication token exposed in URL query parameters

* fix: silence unused hook token url param

* fix: remove gateway auth tokens from URLs (#9436) (thanks @coygeek)

* test: fix Windows path separators in audit test (#9436)

---------

Co-authored-by: George Pickett <gpickett00@gmail.com>
This commit is contained in:
Coy Geek
2026-02-05 18:08:29 -08:00
committed by GitHub
parent b1430aaaca
commit 717129f7f9
22 changed files with 107 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/gateway/server-http.ts
View File

@@ -147,20 +147,22 @@ export function createHooksRequestHandler(
return false;
}
const { token, fromQuery } = extractHookToken(req, url);
if (url.searchParams.has("token")) {
res.statusCode = 400;
res.setHeader("Content-Type", "text/plain; charset=utf-8");
res.end(
"Hook token must be provided via Authorization: Bearer <token> or X-OpenClaw-Token header (query parameters are not allowed).",
);
return true;
}
const token = extractHookToken(req);
if (!token || token !== hooksConfig.token) {
res.statusCode = 401;
res.setHeader("Content-Type", "text/plain; charset=utf-8");
res.end("Unauthorized");
return true;
}
if (fromQuery) {
logHooks.warn(
"Hook token provided via query parameter is deprecated for security reasons. " +
"Tokens in URLs appear in logs, browser history, and referrer headers. " +
"Use Authorization: Bearer <token> or X-OpenClaw-Token header instead.",
);
}
if (req.method !== "POST") {
res.statusCode = 405;