github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-19 02:07:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden BlueBubbles webhook auth behind proxies

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-14 19:47:46 +01:00
parent b1dd23f61d
commit 743f4b2849
4 changed files with 158 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/channels/bluebubbles.md
View File

@@ -44,6 +44,10 @@ Status: bundled plugin that talks to the BlueBubbles macOS server over HTTP. **R
4. Point BlueBubbles webhooks to your gateway (example: `https://your-gateway-host:3000/bluebubbles-webhook?password=<password>`).
5. Start the gateway; it will register the webhook handler and start pairing.
Security note:
- Always set a webhook password. If you expose the gateway through a reverse proxy (Tailscale Serve/Funnel, nginx, Cloudflare Tunnel, ngrok), the proxy may connect to the gateway over loopback. The BlueBubbles webhook handler treats requests with forwarding headers as proxied and will not accept passwordless webhooks.
## Keeping Messages.app alive (VM / headless setups)
Some macOS VM / always-on setups can end up with Messages.app going “idle” (incoming events stop until the app is opened/foregrounded). A simple workaround is to **poke Messages every 5 minutes** using an AppleScript + LaunchAgent.