github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-10 18:24:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce hooks token separation from gateway auth (#20813)

Browse Source 
* fix(an-03): apply security fix

Generated by staged fix workflow.

* fix(an-03): apply security fix

Generated by staged fix workflow.

* fix(an-03): remove stale test-link artifact from patch

Remove accidental a2ui test-link artifact from the tracked diff and keep startup auth enforcement centralized in startup-auth.ts.
This commit is contained in:
Coy Geek
2026-02-19 02:48:08 -08:00
committed by GitHub
parent 267bb3c81c
commit f7a7a28c56
4 changed files with 114 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
src/gateway/startup-auth.ts
View File

@@ -109,6 +109,7 @@ export async function ensureGatewayStartupAuth(params: {
tailscaleOverride: params.tailscaleOverride,
});
if (resolved.mode !== "token" || (resolved.token?.trim().length ?? 0) > 0) {
assertHooksTokenSeparateFromGatewayAuth({ cfg: params.cfg, auth: resolved });
return { cfg: params.cfg, auth: resolved, persistedGeneratedToken: false };
}
@@ -138,6 +139,7 @@ export async function ensureGatewayStartupAuth(params: {
authOverride: params.authOverride,
tailscaleOverride: params.tailscaleOverride,
});
assertHooksTokenSeparateFromGatewayAuth({ cfg: nextCfg, auth: nextAuth });
return {
cfg: nextCfg,
auth: nextAuth,
@@ -145,3 +147,30 @@ export async function ensureGatewayStartupAuth(params: {
persistedGeneratedToken: persist,
};
}
export function assertHooksTokenSeparateFromGatewayAuth(params: {
cfg: OpenClawConfig;
auth: ResolvedGatewayAuth;
}): void {
if (params.cfg.hooks?.enabled !== true) {
return;
}
const hooksToken =
typeof params.cfg.hooks.token === "string" ? params.cfg.hooks.token.trim() : "";
if (!hooksToken) {
return;
}
const gatewayToken =
params.auth.mode === "token" && typeof params.auth.token === "string"
? params.auth.token.trim()
: "";
if (!gatewayToken) {
return;
}
if (hooksToken !== gatewayToken) {
return;
}
throw new Error(
"Invalid config: hooks.token must not match gateway auth token. Set a distinct hooks.token for hook ingress.",
);
}