fix(security): harden browser API auth, token comparisons, and hook tokens#14197
Open
leecarollyn-gif wants to merge 2 commits intoopenclaw:mainfrom
Open
fix(security): harden browser API auth, token comparisons, and hook tokens#14197leecarollyn-gif wants to merge 2 commits intoopenclaw:mainfrom
leecarollyn-gif wants to merge 2 commits intoopenclaw:mainfrom
Conversation
…okens - Extract safeEqual() to shared src/security/safe-equal.ts utility - Replace 7 timing-unsafe token comparisons with constant-time safeEqual (gateway hooks, device pairing, node pairing, bridge server, extension relay) - Add Bearer token auth + Host header validation to browser control API (secure by default with auto-generated token, opt-out via browser.auth.enabled) - Add hooks.allowQueryToken config flag to control query-string token acceptance (default: true for backward compat, deprecation path to false) Based on Codex security audit findings. Co-Authored-By: Claude Opus 4.6 <[email protected]>
openclaw-barnacle
bot
added
gateway
Add guidelines for timing-safe token comparison (safeEqual), browser control API auth, hook token security, and DNS rebinding protection. Co-Authored-By: Claude Opus 4.6 <[email protected]>
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+30
to
+33
| // Host header validation (DNS rebinding protection) | ||
| app.use((req, res, next) => { | ||
| const host = (req.headers.host ?? "").replace(/:\d+$/, "").toLowerCase(); | ||
| if ( |
Contributor
There was a problem hiding this comment.
IPv6 Host parsing bug
(req.headers.host ?? "").replace(/:\d+$/, "") won’t strip the port for bracketed IPv6 hosts (e.g. Host: [::1]:18789), so host becomes "[::1]:18789" and the allowlist check will always 403. This breaks legitimate loopback requests on IPv6. Consider parsing bracketed IPv6 + optional port (or reusing the existing getHostName() helper from src/gateway/auth.ts) before comparing against the allowlist.
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/browser/server.ts
Line: 30:33
Comment:
**IPv6 Host parsing bug**
`(req.headers.host ?? "").replace(/:\d+$/, "")` won’t strip the port for bracketed IPv6 hosts (e.g. `Host: [::1]:18789`), so `host` becomes `"[::1]:18789"` and the allowlist check will always 403. This breaks legitimate loopback requests on IPv6. Consider parsing bracketed IPv6 + optional port (or reusing the existing `getHostName()` helper from `src/gateway/auth.ts`) before comparing against the allowlist.
How can I resolve this? If you propose a fix, please make it concise.
centminmod
added a commit
to centminmod/clawdbot
that referenced
this pull request
Feb 11, 2026
thewilloftheshadow
force-pushed
the
main
branch
from
bfc1ccb to
f92900f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
safeEqual()to shared utility (src/security/safe-equal.ts) for constant-time string comparison, replacing the local copy ingateway/auth.tssafeEqualbrowser.auth.enabled: falsehooks.allowQueryTokenconfig flag to control query-string token acceptance (defaulttruefor backward compat, withDeprecationheader and migration path tofalse)Based on a Codex CLI security audit that identified three categories of vulnerability:
Test plan
pnpm buildpassespnpm checkpasses (type-check + lint + format)safeEqualunit tests pass (5/5)auth: { enabled: false }🤖 Generated with Claude Code
Greptile Overview
Greptile Summary
This PR strengthens several auth-related surfaces:
safeEqual()helper for timing-safe string comparisons and replaces direct===token checks across gateway hooks, pairing flows, browser bridge/relay, and gateway auth.hooks.allowQueryTokento control whether hook tokens are accepted via query string, with deprecation messaging to encourage moving to header-based auth.Overall, the changes align with existing gateway auth patterns and tighten local control surfaces, but there is a correctness bug in the new browser Host validation (see comment).
Confidence Score: 3/5
[::1]:<port>), which can cause 403s for valid requests until fixed.(2/5) Greptile learns from your feedback when you react with thumbs up/down!