fix(gateway): allow loopback node-role sessions without device identity#848
Open
BingqingLyu wants to merge 2 commits intomainfrom
Open
fix(gateway): allow loopback node-role sessions without device identity#848BingqingLyu wants to merge 2 commits intomainfrom
BingqingLyu wants to merge 2 commits intomainfrom
Conversation
Internal services (cron, sessions_spawn, ACP tools) connect from 127.0.0.1 with node role and cannot present device identity. Since v2026.3.12 the evaluateMissingDeviceIdentity gate rejects these connections with "device identity required", breaking all internal service capabilities for headless/server deployments. Device identity prevents MitM on network connections; loopback has no network attack surface. This change allows authenticated loopback node-role sessions through without device identity while preserving all existing constraints: - Remote node connections still require device identity - Loopback node connections with failed auth are still rejected - dangerouslyDisableDeviceAuth scope unchanged (operator Control UI only) - Operator role checks unchanged Closes openclaw#45504 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The cron rejection is actually in shouldSkipBackendSelfPairing, not evaluateMissingDeviceIdentity. When auth.mode=none, authMethod is "none" which matches neither token/password nor device-token, so the backend self-pairing skip never triggers. The cron client provides device identity, passes the device-identity gate, but then fails at the pairing step with "pairing required". Add usesNoAuth to the skip condition: when the gateway is explicitly configured with no auth, its own backend services on loopback should not require pairing. The isGatewayBackendClient + isLocalClient + !hasBrowserOriginHeader guards are sufficient. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
127.0.0.1withnoderole are rejected with "device identity required" — regardless ofgateway.auth.mode.evaluateMissingDeviceIdentityhas no loopback exemption fornoderole. The function's Control UI paths (trustedProxyAuthOk,allowBypass,allowInsecureAuth) all gate onisControlUi, which isfalsefor internal services.roleCanSkipDeviceIdentityonly passes foroperator, sonodealways falls through toreject-device-required.node-role sessions without device identity. Device identity prevents MitM on network connections; loopback has no network attack surface.Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
User-visible / Behavior Changes
sessions_spawn, ACP tool calls) connecting from loopback now work on v2026.3.12+ without device identity, restoring pre-v2026.3.12 behavior.Security Impact (required)
Yes/No): NoYes/No): NoYes/No): NoYes/No): NoYes/No): NoRepro + Verification
Environment
gateway.auth.mode: "none"(also tested withtokenandtrusted-proxy)Steps
cron.enabled: true[ws] closed before connect ... remote=127.0.0.1 code=1008 reason=pairing requiredExpected
Actual
Evidence
Test matrix (production VPS, v2026.3.13)
trusted-proxytokennoneAfter fix
Human Verification (required)
auth.mode=token+ internal cron (tested withnoneonly)Review Conversations
Compatibility / Migration
Yes/No): YesYes/No): NoYes/No): NoFailure Recovery (if this breaks)
ifguard inevaluateMissingDeviceIdentity— no config or state changes.Risks and Mitigations
noderole + loopback +authOk— auth is still enforced. Device identity prevents network MitM, which is irrelevant on loopback. Remote node connections unchanged.authOkis alwaystrueforauth.mode=none, so any loopback node connection is allowed.auth.mode=nonealready allows any connection without credentials — device identity added no security value in this configuration.Why this is separate from openclaw#45590
PR openclaw#45590 fixes the
dangerouslyDisableDeviceAuthbypass for operator Control UI sessions. That fix does not help internal services because they connect withrole: "node"andisControlUi: false— none of the Control UI code paths apply. This PR addresses the distinct regression for node-role loopback connections.