Vignesh Natarajan
d86a12eb62
fix(gateway): honor insecure ws override for remote hostnames
2026-03-05 17:04:26 -08:00
Alberto Leal
449511484d
fix(gateway): allow ws:// to private network addresses ( #28670 )
...
* fix(gateway): allow ws:// to RFC 1918 private network addresses
resolve ws-private-network conflicts
* gateway: keep ws security strict-by-default with private opt-in
* gateway: apply private ws opt-in in connection detail guard
* gateway: apply private ws opt-in in websocket client
* onboarding: gate private ws urls behind explicit opt-in
* gateway tests: enforce strict ws defaults with private opt-in
* onboarding tests: validate private ws opt-in behavior
* gateway client tests: cover private ws env override
* gateway call tests: cover private ws env override
* changelog: add ws strict-default security entry for pr 28670
* docs(onboard): document private ws break-glass env
* docs(gateway): add private ws env to remote guide
* docs(docker): add private ws break-glass env var
* docs(security): add private ws break-glass guidance
* docs(config): document OPENCLAW_ALLOW_PRIVATE_WS
* Update CHANGELOG.md
* gateway: normalize private-ws host classification
* test(gateway): cover non-unicast ipv6 private-ws edges
* changelog: rename insecure private ws break-glass env
* docs(onboard): rename insecure private ws env
* docs(gateway): rename insecure private ws env in config reference
* docs(gateway): rename insecure private ws env in remote guide
* docs(security): rename insecure private ws env
* docs(docker): rename insecure private ws env
* test(onboard): rename insecure private ws env
* onboard: rename insecure private ws env
* test(gateway): rename insecure private ws env in call tests
* gateway: rename insecure private ws env in call flow
* test(gateway): rename insecure private ws env in client tests
* gateway: rename insecure private ws env in client
* docker: pass insecure private ws env to services
* docker-setup: persist insecure private ws env
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-03-01 20:49:45 -08:00
Peter Steinberger
75423a00d6
refactor: deduplicate shared helpers and test setup
2026-02-23 20:40:44 +00:00
Peter Steinberger
08431da5d5
refactor(gateway): unify credential precedence across entrypoints
2026-02-22 18:55:44 +01:00
Peter Steinberger
66529c7aa5
refactor(gateway): unify auth credential resolution
2026-02-22 18:23:13 +01:00
Brian Mendonca
8a3d04c19c
Gateway UX: harden remote ws guidance and onboarding defaults
2026-02-22 12:46:20 +01:00
Peter Steinberger
9daab2abb3
test(gateway): use lightweight clears in client close setup
2026-02-22 08:01:16 +00:00
Peter Steinberger
b109fa53ea
refactor(core): dedupe gateway runtime and config tests
2026-02-22 07:44:57 +00:00
Mariano
5dd304d1c6
fix(gateway): clear pairing state on device token mismatch ( #22071 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: ad38d1a529132747814+mbelinky@users.noreply.github.com >
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com >
Reviewed-by: @mbelinky
2026-02-20 18:21:13 +00:00
Jay Caldwell
9edec67a18
fix(security): block plaintext WebSocket connections to non-loopback addresses ( #20803 )
...
* fix(security): block plaintext WebSocket connections to non-loopback addresses
Addresses CWE-319 (Cleartext Transmission of Sensitive Information).
Previously, ws:// connections to remote hosts were allowed, exposing
both credentials and chat data to network interception. This change
blocks ALL plaintext ws:// connections to non-loopback addresses,
regardless of whether explicit credentials are configured (device
tokens may be loaded dynamically).
Security policy:
- wss:// allowed to any host
- ws:// allowed only to loopback (127.x.x.x, localhost, ::1)
- ws:// to LAN/tailnet/remote hosts now requires TLS
Changes:
- Add isSecureWebSocketUrl() validation in net.ts
- Block insecure connections in GatewayClient.start()
- Block insecure URLs in buildGatewayConnectionDetails()
- Handle malformed URLs gracefully without crashing
- Update tests to use wss:// for non-loopback URLs
Fixes #12519
* fix(test): update gateway-chat mock to preserve net.js exports
Use importOriginal to spread actual module exports and mock only
the functions needed for testing. This ensures isSecureWebSocketUrl
and other exports remain available to the code under test.
2026-02-19 03:13:08 -08:00
Shakker
ae93bc9f51
fix(gateway): make stale token cleanup non-fatal
2026-02-17 14:29:41 +00:00
Peter Steinberger
9131b22a28
test: migrate suites to e2e coverage layout
2026-02-13 14:28:22 +00:00
cpojer
f06dd8df06
chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.
2026-02-01 10:03:47 +09:00
cpojer
5ceff756e1
chore: Enable "curly" rule to avoid single-statement if confusion/errors.
2026-01-31 16:19:20 +09:00
Peter Steinberger
dcb8d16591
fix: validate ws tls fingerprint
2026-01-20 13:04:20 +00:00
Peter Steinberger
c379191f80
chore: migrate to oxlint and oxfmt
...
Co-authored-by: Christoph Nakazawa <christoph.pojer@gmail.com >
2026-01-14 15:02:19 +00:00
Peter Steinberger
918cbdcf03
refactor: lint cleanups and helpers
2025-12-23 00:28:55 +00:00
Peter Steinberger
d5d80f4247
feat(gateway)!: switch handshake to req:connect (protocol v2)
2025-12-12 23:29:57 +00:00
Peter Steinberger
96be7c8990
tests: cover agent sequencing, tick watchdog, presence fingerprint
2025-12-09 17:05:47 +01:00
