Description

ClawControl desktop app (v1.5.0, Electron) connecting to gateway over Tailscale Serve cannot connect despite app://localhost being explicitly set in gateway.controlUi.allowedOrigins.

Environment

• OpenClaw version: 2026.3.2
• ClawControl version: 1.5.0 (Electron/28.3.3)
• OS (gateway): Linux 6.17.0-14-generic (x64)
• Connection: Tailscale Serve (https://host.tail*.ts.net → http://127.0.0.1:18789)

Steps to Reproduce

1. Set gateway.controlUi.allowedOrigins to ["app://localhost"] via openclaw config set
2. Restart gateway (systemctl --user restart openclaw-gateway)
3. Connect from ClawControl desktop app over Tailscale (wss://host.tail*.ts.net)
4. Gateway rejects with: origin not allowed (open the Control UI from the gateway host or allow it in gateway.controlUi.allowedOrigins)

What was tried

• allowedOrigins: ["app://localhost"] — rejected
• allowedOrigins: ["app://localhost", "https://host.tail*.ts.net", "http://host.tail*.ts.net"] — rejected
• dangerouslyAllowHostHeaderOriginFallback: true — still rejected
• allowedOrigins: ["*"] — this works ✅

Logs

Gateway logs confirm the origin is app://localhost and host is the Tailscale hostname:

cause: origin-mismatch
origin: app://localhost
host: host.tail*.ts.net
forwardedFor: <tailscale-ip>
reason: origin not allowed
client: openclaw-control-ui
clientDisplayName: Gregs Laptop

Expected Behavior

app://localhost in allowedOrigins should match the app://localhost origin sent by the ClawControl Electron app.

Workaround

Setting allowedOrigins: ["*"] works but is overly permissive.