vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-05 13:20:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(ui): harden legacy query token guidance (#49053)

Browse Source
This commit is contained in:
Val Alexander
2026-03-17 22:18:42 -05:00
committed by GitHub
parent 0a90b07f8d
commit 56066dccb0
3 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/web/control-ui.md
View File

@@ -242,7 +242,7 @@ http://localhost:5173/?gatewayUrl=wss://<gateway-host>:18789#token=<gateway-toke
Notes:
- `gatewayUrl` is stored in localStorage after load and removed from the URL.
- `token` is preferably imported from the URL fragment, stored in sessionStorage for the current browser tab session and selected gateway URL, and stripped from the URL; legacy `?token=` query params are also imported once for compatibility and then removed.
- `token` should be passed via the URL fragment (`#token=...`) whenever possible. Fragments are not sent to the server, which avoids request-log and Referer leakage. Legacy `?token=` query params are still imported once for compatibility, but only as a fallback, and are stripped immediately after bootstrap.
- `password` is kept in memory only.
- When `gatewayUrl` is set, the UI does not fall back to config or environment credentials.
Provide `token` (or `password`) explicitly. Missing explicit credentials is an error.