fix(ui): keep shared auth on insecure control-ui connects by velvet-shark · Pull Request #45088 · openclaw/openclaw

velvet-shark · 2026-03-13T12:48:30Z

Summary

Problem: plain-HTTP Control UI sessions behind LAN and reverse-proxy setups were dropping explicit shared token/password auth before the first WebSocket connect frame, so the gateway rejected them with device identity required.
Why it matters: this broke the intended allowInsecureAuth + dangerouslyDisableDeviceAuth token flow for self-hosted HTTP deployments even though same-tab refresh/navigation had already been fixed separately.
What changed: initialize Control UI connect auth from the explicit shared token/password before the secure-context device-auth branch, and add regression tests for insecure token/password connects.
What did NOT change (scope boundary): cached device-token fallback is still limited to the existing trusted retry path, and this PR does not change the #40892 sessionStorage same-tab behavior or add any cross-tab token sharing.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Control UI now preserves explicit shared token auth on insecure http:// first-connect flows instead of dropping auth before the first WebSocket handshake.
Control UI now preserves explicit shared password auth on the same insecure first-connect path.
Cached device tokens are still not sent on the insecure first connect.

Security Impact (required)

New permissions/capabilities? (No)
Secrets/tokens handling changed? (Yes)
New/changed network calls? (No)
Command/tool execution surface changed? (No)
Data access scope changed? (No)
If any Yes, explain risk + mitigation:

This restores the explicit token/password that the operator already supplied to the existing first-connect frame on insecure Control UI sessions. It does not broaden cached device-token fallback, does not add storage, and keeps the trusted retry boundary unchanged.

Repro + Verification

Environment

OS: macOS 15.7.4 (arm64)
Runtime/container: Control UI Vitest projects + local runtime repro script
Model/provider: N/A
Integration/channel (if any): Control UI
Relevant config (redacted): gateway.auth.mode: "token", gateway.controlUi.allowInsecureAuth: true, gateway.controlUi.dangerouslyDisableDeviceAuth: true

Steps

Open the Control UI over plain HTTP with an explicit shared token or password configured.
Let the browser receive the WebSocket connect.challenge event.
Inspect the first connect request payload.

Expected

The first connect frame includes the explicit shared token or password.
No cached device token is sent on that insecure first connect.

Actual

Before this fix, insecure contexts built the first connect frame from an empty auth selection state, so params.auth was omitted entirely.

Evidence

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios:
- insecure http:// connect with explicit shared token now sends auth.token
- insecure http:// connect with explicit shared password now sends auth.password
- existing trusted one-shot device-token retry tests still pass unchanged
- existing same-tab navigation/refresh browser tests from #40892 still pass
Edge cases checked:
- insecure first-connect still omits cached deviceToken
- secure-context explicit shared auth still signs with the shared token rather than the cached device token
What you did not verify:
- a manual live repro against a remote VPS/reverse-proxy deployment

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

Backward compatible? (Yes)
Config/env changes? (No)
Migration needed? (No)
If yes, exact upgrade steps:

Failure Recovery (if this breaks)

How to disable/revert this change quickly: revert commit 60abd798cffa99a9f03ac9936c47e8dc3f87deca
Files/config to restore: ui/src/ui/gateway.ts and ui/src/ui/gateway.node.test.ts
Known bad symptoms reviewers should watch for: insecure HTTP Control UI connects still fail with device identity required, or cached device tokens start appearing on the first insecure connect

Risks and Mitigations

Risk: restoring explicit shared auth on insecure contexts could accidentally reintroduce cached device-token fallback on the same path.
- Mitigation: the new tests assert token/password presence while also asserting deviceToken stays absent.

aisle-research-bot · 2026-03-13T12:48:43Z

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

#	Severity	Title
1	🟠 High	Control UI sends shared token/password over potentially plaintext WebSocket in insecure contexts

1. 🟠 Control UI sends shared token/password over potentially plaintext WebSocket in insecure contexts

Property	Value
Severity	High
CWE	CWE-319
Location	`ui/src/ui/gateway.ts:240-275`

Description

In GatewayBrowserClient.sendConnect(), the client now includes opts.token / opts.password in the connect request even when running in a non-secure browser context (where crypto.subtle is unavailable).

isSecureContext is determined only via crypto.subtle availability, not by checking whether the WebSocket URL uses wss://.
When the configured gateway URL is ws://..., the connect frame is sent via WebSocket.send(...) in cleartext, exposing the shared token/password to passive network observers / MitM (LAN, Wi‑Fi, misconfigured reverse proxy paths).
Prior behavior avoided sending explicit shared auth in insecure contexts (selectedAuth started empty), reducing credential exposure before the first handshake.

Vulnerable flow:

Input: this.opts.token / this.opts.password
Auth frame creation: auth = { token, password, ... }
Sink: this.ws.send(JSON.stringify(frame)) over ws:// when configured

Recommendation

Prevent shared credentials from being sent over plaintext transport.

Suggested hardening (client-side):

Parse this.opts.url and block sending token/password when the WebSocket protocol is ws: unless the target is loopback.
Preferably require wss: whenever token/password is set.
If insecure auth must be supported for localhost, gate it explicitly (e.g., allowInsecureCredentialSend: true) and show a prominent UI warning.

Example:

const gatewayUrl = new URL(this.opts.url, window.location.href);
const isWsPlaintext = gatewayUrl.protocol === "ws:";
const isLoopback = ["localhost", "127.0.0.1", "::1"].includes(gatewayUrl.hostname);

const explicitGatewayToken = this.opts.token?.trim() || undefined;
const explicitPassword = this.opts.password?.trim() || undefined;

if (isWsPlaintext && !isLoopback && (explicitGatewayToken || explicitPassword)) {
  throw new Error("Refusing to send credentials over ws://; use wss://");
}

Server-side guidance (docs/config):

Recommend wss:// (TLS) for any non-loopback Control UI usage; avoid enabling insecure auth except for true localhost scenarios.

Analyzed PR: #45088 at commit 99eb3fd

_{Last updated on: 2026-03-13T13:43:24Z}

greptile-apps · 2026-03-13T12:50:57Z

Greptile Summary

This PR fixes a bug where plain-HTTP (insecure context) Control UI sessions dropped explicit shared token/password auth before the first WebSocket connect frame, causing the gateway to reject connections with "device identity required."

Root cause: selectedAuth was initialized as { canFallbackToShared: false } with no authToken/authPassword. On insecure contexts, the if (isSecureContext) branch was skipped entirely, so selectedAuth.authToken stayed undefined and the auth parameter was omitted from the connect frame.

Fix: Pre-populate selectedAuth with the explicit token/password before the isSecureContext branch. In secure contexts, selectConnectAuth() still fully overwrites selectedAuth (including re-reading this.opts.token and this.opts.password), so there is no behavioral regression on HTTPS/localhost paths.

Key points:

The fix is minimal and surgical — only 6 lines changed in gateway.ts
New tests correctly verify token and password paths on insecure connect, and assert that device-identity operations (loadOrCreateDeviceIdentity, signDevicePayload) are not invoked
The stubInsecureCrypto helper correctly simulates an insecure context by removing crypto.subtle while keeping crypto.randomUUID for request ID generation
The device token retry boundary is unchanged — Boolean(deviceIdentity) in the catch block's shouldRetryWithDeviceToken check remains false on insecure contexts

Confidence Score: 5/5

This PR is safe to merge — the change is minimal, well-tested, and does not expand the cached device-token fallback path.
The fix is a single-method, 6-line change with clear before/after behavior. The secure context path is unaffected because selectConnectAuth() fully overwrites selectedAuth. Two targeted regression tests cover the token and password cases, and each asserts that loadOrCreateDeviceIdentity and signDevicePayload are not called. Existing tests continue to cover the secure context and device token retry paths.
No files require special attention.

_{Last reviewed commit: e5fbf3d}

velvet-shark · 2026-03-13T13:26:12Z

Merged via squash.

Prepared head SHA: 99eb3fd9281549a4e012b63eb9608dc47455ad03
Merge commit: 0a3b9a9a090ab2ae1dbf6eb8d044e20af165c0d1

Thanks @velvet-shark!

* main: (168 commits) fix: stabilize macos daemon onboarding fix(ui): keep shared auth on insecure control-ui connects (openclaw#45088) docs(plugins): clarify workspace shadowing fix(node-host): harden perl approval binding fix(node-host): harden pnpm approval binding fix(discovery): add missing domain to wideArea Zod config schema (openclaw#35615) chore(gitignore): add docker-compose override (openclaw#42879) feat(ios): add onboarding welcome pager (openclaw#45054) fix(signal): add groups config to Signal channel schema (openclaw#27199) fix: restore web fetch firecrawl config in runtime zod schema (openclaw#42583) fix: polish Android QR scanner onboarding (openclaw#45021) fix(android): use Google Code Scanner for onboarding QR fix(config): add missing params field to agents.list[] validation schema (openclaw#41171) docs(contributing): update Android app ownership fix(agents): rephrase session reset prompt to avoid Azure content filter (openclaw#43403) test(config): cover requiresOpenAiAnthropicToolPayload in compat schema fixture fix(agents): respect explicit user compat overrides for non-native openai-completions (openclaw#44432) Android: fix HttpURLConnection leak in TalkModeVoiceResolver (openclaw#43780) Docker: add OPENCLAW_TZ timezone support (openclaw#34119) fix(agents): avoid injecting memory file twice on case-insensitive mounts (openclaw#26054) ...

@velvet-shark

* fix(node-host): harden pnpm approval binding * fix(node-host): harden perl approval binding * docs(plugins): clarify workspace shadowing * fix(ui): keep shared auth on insecure control-ui connects (openclaw#45088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark * docs: add Claude Code token efficiency playbook * docs: compress playbook for agent consumption * docs: restructure playbook for long-context patterns * pre-commit: add incremental repo-map updater Auto-updates docs/repo-map.json exports and dependencies when src/ or extensions/ .ts files are committed. Preserves existing purpose fields, removes deleted files, adds new files with empty purpose. Regex-based extraction, no dependencies. --------- Co-authored-by: Peter Steinberger <[email protected]> Co-authored-by: Radek Sienkiewicz <[email protected]> Co-authored-by: velvet-shark <[email protected]>

@velvet-shark

…5088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark

@velvet-shark

…5088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark

@velvet-shark

…5088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark

@velvet-shark

…5088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark

@velvet-shark

* fix(node-host): harden pnpm approval binding * fix(node-host): harden perl approval binding * docs(plugins): clarify workspace shadowing * fix(ui): keep shared auth on insecure control-ui connects (openclaw#45088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark * docs: add Claude Code token efficiency playbook * docs: compress playbook for agent consumption * docs: restructure playbook for long-context patterns * pre-commit: add incremental repo-map updater Auto-updates docs/repo-map.json exports and dependencies when src/ or extensions/ .ts files are committed. Preserves existing purpose fields, removes deleted files, adds new files with empty purpose. Regex-based extraction, no dependencies. --------- Co-authored-by: Peter Steinberger <[email protected]> Co-authored-by: Radek Sienkiewicz <[email protected]> Co-authored-by: velvet-shark <[email protected]>

@velvet-shark

…5088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark

@velvet-shark

* fix(node-host): harden pnpm approval binding * fix(node-host): harden perl approval binding * docs(plugins): clarify workspace shadowing * fix(ui): keep shared auth on insecure control-ui connects (openclaw#45088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark * docs: add Claude Code token efficiency playbook * docs: compress playbook for agent consumption * docs: restructure playbook for long-context patterns * pre-commit: add incremental repo-map updater Auto-updates docs/repo-map.json exports and dependencies when src/ or extensions/ .ts files are committed. Preserves existing purpose fields, removes deleted files, adds new files with empty purpose. Regex-based extraction, no dependencies. --------- Co-authored-by: Peter Steinberger <[email protected]> Co-authored-by: Radek Sienkiewicz <[email protected]> Co-authored-by: velvet-shark <[email protected]>

@velvet-shark

* fix(node-host): harden pnpm approval binding * fix(node-host): harden perl approval binding * docs(plugins): clarify workspace shadowing * fix(ui): keep shared auth on insecure control-ui connects (openclaw#45088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark * docs: add Claude Code token efficiency playbook * docs: compress playbook for agent consumption * docs: restructure playbook for long-context patterns * pre-commit: add incremental repo-map updater Auto-updates docs/repo-map.json exports and dependencies when src/ or extensions/ .ts files are committed. Preserves existing purpose fields, removes deleted files, adds new files with empty purpose. Regex-based extraction, no dependencies. --------- Co-authored-by: Peter Steinberger <[email protected]> Co-authored-by: Radek Sienkiewicz <[email protected]> Co-authored-by: velvet-shark <[email protected]>

@velvet-shark

…5088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark

@velvet-shark

* fix(node-host): harden pnpm approval binding * fix(node-host): harden perl approval binding * docs(plugins): clarify workspace shadowing * fix(ui): keep shared auth on insecure control-ui connects (openclaw#45088) Merged via squash. Prepared head SHA: 99eb3fd Co-authored-by: velvet-shark <[email protected]> Co-authored-by: velvet-shark <[email protected]> Reviewed-by: @velvet-shark * docs: add Claude Code token efficiency playbook * docs: compress playbook for agent consumption * docs: restructure playbook for long-context patterns * pre-commit: add incremental repo-map updater Auto-updates docs/repo-map.json exports and dependencies when src/ or extensions/ .ts files are committed. Preserves existing purpose fields, removes deleted files, adds new files with empty purpose. Regex-based extraction, no dependencies. --------- Co-authored-by: Peter Steinberger <[email protected]> Co-authored-by: Radek Sienkiewicz <[email protected]> Co-authored-by: velvet-shark <[email protected]>

openclaw-barnacle bot added the app: web-ui App: web-ui label Mar 13, 2026

openclaw-barnacle bot added size: S maintainer Maintainer-authored PR labels Mar 13, 2026

velvet-shark mentioned this pull request Mar 13, 2026

fix(gateway): always resolve device token for fallback auth during SPA navigation #45070

Closed

velvet-shark self-assigned this Mar 13, 2026

velvet-shark force-pushed the codex/fix-control-ui-insecure-shared-auth branch 3 times, most recently from 6a34bf0 to e27b2dd Compare March 13, 2026 13:20

fix(ui): keep shared auth on insecure control-ui connects

99eb3fd

velvet-shark force-pushed the codex/fix-control-ui-insecure-shared-auth branch from e27b2dd to 99eb3fd Compare March 13, 2026 13:25

velvet-shark merged commit 0a3b9a9 into main Mar 13, 2026
10 checks passed

velvet-shark deleted the codex/fix-control-ui-insecure-shared-auth branch March 13, 2026 13:25

github-actions bot mentioned this pull request Mar 13, 2026

📡 Upstream Digest — 2026-03-13 14:37 UTC curtismercier/openclaw-mods#253

Open

This was referenced Mar 13, 2026

fix(ui): send token/password auth in Control UI insecure contexts #44865

Closed

[Bug]: Control UI fails to authenticate over plain HTTP (insecure context) #44864

Closed

jmcte mentioned this pull request Mar 13, 2026

Control UI 在 2026.3.12 版本中无法通过 HTTP + Token 认证访问，2026.3.2 版本正常工作 / Control UI authentication via HTTP + Token fails in 2026.3.12 but works in 2026.3.2 #45401

Closed

github-actions bot mentioned this pull request Mar 15, 2026

📢 OpenClaw 新版本发布: v2026.3.13-1 xianyu110/awesome-openclaw-tutorial#32

Closed

5 tasks

steipete mentioned this pull request Mar 16, 2026

fix(webchat): add missing operator.read and operator.write scopes #47378

Closed

rocky-d mentioned this pull request Mar 16, 2026

[Bug]: WebChat "missing scope: operator.write" Error #46997

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(ui): keep shared auth on insecure control-ui connects#45088

fix(ui): keep shared auth on insecure control-ui connects#45088
velvet-shark merged 1 commit intomainfrom
codex/fix-control-ui-insecure-shared-auth

velvet-shark commented Mar 13, 2026

Uh oh!

aisle-research-bot bot commented Mar 13, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 13, 2026

Uh oh!

Uh oh!

velvet-shark commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

velvet-shark commented Mar 13, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Uh oh!

aisle-research-bot bot commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Aisle Security Analysis

1. 🟠 Control UI sends shared token/password over potentially plaintext WebSocket in insecure contexts

Description

Recommendation

Uh oh!

greptile-apps bot commented Mar 13, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

Uh oh!

velvet-shark commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

aisle-research-bot bot commented Mar 13, 2026 •

edited

Loading