fix(gateway): fail closed for trusted-proxy auth

steipete · steipete · commit 84dd9c73953b · 2026-05-08T00:21:08.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -156,6 +156,7 @@ Docs: https://docs.openclaw.ai
 ### Fixes
 
 - Providers: preserve non-OK `text/event-stream` response bodies so provider HTTP errors keep their JSON detail instead of collapsing to generic streaming failures. Fixes #78180.
+- Gateway/auth: make explicit `trusted-proxy` mode fail closed instead of accepting local password fallback credentials after trusted-proxy identity checks fail. Fixes #78684.
 - Tools/session status: render the active heartbeat/run model for `session_status({"sessionKey":"current"})` instead of falling back to the persisted session default. Fixes #77493.
 - Doctor/secrets: allow safe inherited exec SecretRef `passEnv` names such as `HOME` while still blocking dangerous runtime env hooks. Fixes #78216.
 - Chat commands: make `/model default` reset the session model override instead of treating it as a literal model name. Fixes #78182.
diff --git a/src/gateway/auth.test.ts b/src/gateway/auth.test.ts
@@ -964,35 +964,35 @@ describe("trusted-proxy auth", () => {
       expect(res.reason).toBe("trusted_proxy_loopback_source");
     });
 
-    it("accepts local-direct password fallback when trusted-proxy auth fails", async () => {
+    it("rejects local-direct password credentials when trusted-proxy auth fails", async () => {
       const limiter = createLimiterSpy();
       const res = await authorizeLocalDirect({
         password: "local-password", // pragma: allowlist secret
         connectPassword: "local-password", // pragma: allowlist secret
         rateLimiter: limiter,
       });
 
-      expect(res).toEqual({ ok: true, method: "password" });
-      expect(limiter.check).toHaveBeenCalledWith("127.0.0.1", "shared-secret");
-      expect(limiter.reset).toHaveBeenCalledWith("127.0.0.1", "shared-secret");
+      expect(res).toEqual({ ok: false, reason: "trusted_proxy_loopback_source" });
+      expect(limiter.check).not.toHaveBeenCalled();
+      expect(limiter.reset).not.toHaveBeenCalled();
       expect(limiter.recordFailure).not.toHaveBeenCalled();
     });
 
-    it("rejects wrong local-direct password fallback and records the failure", async () => {
+    it("ignores wrong local-direct password credentials when trusted-proxy auth fails", async () => {
       const limiter = createLimiterSpy();
       const res = await authorizeLocalDirect({
         password: "local-password", // pragma: allowlist secret
         connectPassword: "wrong-password", // pragma: allowlist secret
         rateLimiter: limiter,
       });
 
-      expect(res).toEqual({ ok: false, reason: "password_mismatch" });
-      expect(limiter.check).toHaveBeenCalledWith("127.0.0.1", "shared-secret");
-      expect(limiter.recordFailure).toHaveBeenCalledWith("127.0.0.1", "shared-secret");
+      expect(res).toEqual({ ok: false, reason: "trusted_proxy_loopback_source" });
+      expect(limiter.check).not.toHaveBeenCalled();
+      expect(limiter.recordFailure).not.toHaveBeenCalled();
       expect(limiter.reset).not.toHaveBeenCalled();
     });
 
-    it("enforces rate-limit lockout before local-direct password fallback", async () => {
+    it("does not apply shared-secret rate limits to trusted-proxy failures", async () => {
       const limiter = createLimiterSpy();
       limiter.check.mockReturnValueOnce({
         allowed: false,
@@ -1006,12 +1006,8 @@ describe("trusted-proxy auth", () => {
         rateLimiter: limiter,
       });
 
-      expect(res).toEqual({
-        ok: false,
-        reason: "rate_limited",
-        rateLimited: true,
-        retryAfterMs: 2500,
-      });
+      expect(res).toEqual({ ok: false, reason: "trusted_proxy_loopback_source" });
+      expect(limiter.check).not.toHaveBeenCalled();
       expect(limiter.recordFailure).not.toHaveBeenCalled();
       expect(limiter.reset).not.toHaveBeenCalled();
     });
diff --git a/src/gateway/auth.ts b/src/gateway/auth.ts
@@ -466,26 +466,6 @@ async function authorizeGatewayConnectCore(
       }
       return { ok: true, method: "trusted-proxy", user: result.user };
     }
-    if (localDirect && auth.password && connectAuth?.password) {
-      if (limiter) {
-        const rlCheck: RateLimitCheckResult = limiter.check(ip, rateLimitScope);
-        if (!rlCheck.allowed) {
-          return {
-            ok: false,
-            reason: "rate_limited",
-            rateLimited: true,
-            retryAfterMs: rlCheck.retryAfterMs,
-          };
-        }
-      }
-      return authorizePasswordAuth({
-        authPassword: auth.password,
-        connectPassword: connectAuth.password,
-        limiter,
-        ip,
-        rateLimitScope,
-      });
-    }
     return { ok: false, reason: result.reason };
   }
 
