fix(control-ui): share gateway token scope across loopback hosts

openclaw-clownfish[bot] · openclaw-clownfish[bot] · commit 2057d4113898 · 2026-04-29T02:34:05.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,6 +13,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Control UI: share current-tab gateway tokens across true loopback aliases while preserving protocol, port, and path isolation, so localhost, 127/8, and bracketed IPv6 loopback dashboard links can reuse same-machine auth without leaking across distinct gateways. Carries forward #43254; refs #17745. Thanks @ssdiwu.
 - Gateway/shutdown: report structured shutdown warnings and HTTP close timeout warnings through `ShutdownResult` while preserving lifecycle hook hardening. Carries forward #41296. Thanks @edenfunf.
 - Plugins/QA: prebuild the private QA channel runtime before plugin gauntlet source runs so wrapper CPU/RSS measurements are not polluted by private QA dist rebuild work. Thanks @vincentkoc.
 - Gateway/reload: bound default restart deferral and SIGUSR1 restart drain to five minutes while preserving explicit `deferralTimeoutMs: 0` indefinite waits, so stale active work accounting cannot block config reloads forever. Thanks @vincentkoc.
diff --git a/ui/src/ui/storage.node.test.ts b/ui/src/ui/storage.node.test.ts
@@ -44,6 +44,28 @@ function expectedGatewayUrl(basePath: string): string {
   return `${proto}://${location.host}${basePath}`;
 }
 
+type UiSettingsFixture = Parameters<typeof saveSettings>[0];
+
+function createUiSettingsFixture(overrides: Partial<UiSettingsFixture> = {}): UiSettingsFixture {
+  return {
+    gatewayUrl: expectedGatewayUrl(""),
+    token: "",
+    sessionKey: "main",
+    lastActiveSessionKey: "main",
+    theme: "claw",
+    themeMode: "system",
+    chatFocusMode: false,
+    chatShowThinking: true,
+    chatShowToolCalls: true,
+    splitRatio: 0.6,
+    navCollapsed: false,
+    navWidth: 220,
+    navGroupsCollapsed: {},
+    borderRadius: 50,
+    ...overrides,
+  };
+}
+
 function createCustomThemeFixture() {
   return normalizeImportedCustomTheme(
     {
@@ -239,6 +261,68 @@ describe("loadSettings default gateway URL derivation", () => {
     });
   });
 
+  it("shares same-tab tokens across true loopback aliases on the same protocol port and path", async () => {
+    setTestLocation({
+      protocol: "http:",
+      host: "127.0.0.1:18789",
+      pathname: "/openclaw",
+    });
+
+    saveSettings(
+      createUiSettingsFixture({
+        gatewayUrl: "ws://127.0.0.1:18789/openclaw",
+        token: "loopback-token",
+      }),
+    );
+
+    expect(sessionStorage.getItem("openclaw.control.token.v1:ws://localhost:18789/openclaw")).toBe(
+      "loopback-token",
+    );
+
+    localStorage.clear();
+
+    for (const host of ["localhost:18789", "127.255.255.255:18789", "[::1]:18789"]) {
+      setTestLocation({
+        protocol: "http:",
+        host,
+        pathname: "/openclaw",
+      });
+      expect(loadSettings()).toMatchObject({
+        gatewayUrl: expectedGatewayUrl("/openclaw"),
+        token: "loopback-token",
+      });
+    }
+  });
+
+  it("keeps loopback token scope isolated by protocol port path and DNS hostnames", async () => {
+    setTestLocation({
+      protocol: "http:",
+      host: "127.0.0.1:18789",
+      pathname: "/openclaw",
+    });
+
+    saveSettings(
+      createUiSettingsFixture({
+        gatewayUrl: "ws://127.0.0.1:18789/openclaw",
+        token: "loopback-token",
+      }),
+    );
+    localStorage.clear();
+
+    for (const locationParams of [
+      { protocol: "http:", host: "127.0.0.1:18790", pathname: "/openclaw" },
+      { protocol: "https:", host: "127.0.0.1:18789", pathname: "/openclaw" },
+      { protocol: "http:", host: "127.0.0.1:18789", pathname: "/other" },
+      { protocol: "http:", host: "127.0.0.1.example:18789", pathname: "/openclaw" },
+    ]) {
+      setTestLocation(locationParams);
+      expect(loadSettings()).toMatchObject({
+        gatewayUrl: expectedGatewayUrl(locationParams.pathname),
+        token: "",
+      });
+    }
+  });
+
   it("does not reuse a session token for a different gatewayUrl", async () => {
     setTestLocation({
       protocol: "https:",
diff --git a/ui/src/ui/storage.ts b/ui/src/ui/storage.ts
@@ -5,11 +5,37 @@ const LOCAL_ASSISTANT_IDENTITY_KEY = "openclaw.control.assistant.v1";
 const LEGACY_TOKEN_SESSION_KEY = "openclaw.control.token.v1";
 const TOKEN_SESSION_KEY_PREFIX = "openclaw.control.token.v1:";
 const MAX_SCOPED_SESSION_ENTRIES = 10;
+const LOOPBACK_TOKEN_SCOPE_HOST = "localhost";
 
 function settingsKeyForGateway(gatewayUrl: string): string {
   return `${SETTINGS_KEY_PREFIX}${normalizeGatewayTokenScope(gatewayUrl)}`;
 }
 
+function isIpv4LoopbackLiteral(hostname: string): boolean {
+  const parts = hostname.split(".");
+  if (parts.length !== 4) {
+    return false;
+  }
+  const octets = parts.map((part) => {
+    if (!/^\d+$/.test(part)) {
+      return Number.NaN;
+    }
+    return Number(part);
+  });
+  return (
+    octets[0] === 127 &&
+    octets.every((octet) => Number.isInteger(octet) && octet >= 0 && octet <= 255)
+  );
+}
+
+function normalizeGatewayTokenScopeHost(hostname: string): string {
+  const normalized = hostname.toLowerCase();
+  if (normalized === "localhost" || normalized === "[::1]" || isIpv4LoopbackLiteral(normalized)) {
+    return LOOPBACK_TOKEN_SCOPE_HOST;
+  }
+  return hostname;
+}
+
 type ScopedSessionSelection = {
   sessionKey: string;
   lastActiveSessionKey: string;
@@ -116,7 +142,12 @@ function normalizeGatewayTokenScope(gatewayUrl: string): string {
     const parsed = base ? new URL(trimmed, base) : new URL(trimmed);
     const pathname =
       parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/+$/, "") || parsed.pathname;
-    return `${parsed.protocol}//${parsed.host}${pathname}`;
+    const scopeHost = normalizeGatewayTokenScopeHost(parsed.hostname);
+    const host =
+      scopeHost === parsed.hostname
+        ? parsed.host
+        : `${scopeHost}${parsed.port ? `:${parsed.port}` : ""}`;
+    return `${parsed.protocol}//${host}${pathname}`;
   } catch {
     return trimmed;
   }
