Bug type

Behavior bug (incorrect output/state without crash)

Summary

The gateway.controlUi.allowedOrigins configuration works with wildcard ("*") but rejects specific origins when the connecting client uses a non-standard URL scheme like tauri:// (Tauri apps) or electron:// (Electron apps).

Steps to reproduce

1. Configure allowedOrigins with a specific Tauri origin:

   "gateway": {
     "controlUi": {
       "allowedOrigins": [
         "tauri://localhost",
         "https://example.com"
       ]
     }
   }
   

2. Launch Control UI from a Tauri desktop app
3. WebSocket connection fails with:
   {"cause":"origin-mismatch","reason":"origin not allowed","origin":"tauri://localhost"}

Expected behavior

• Specific origins should work regardless of URL scheme
• tauri://localhost should be accepted when listed in allowedOrigins

Actual behavior

• Only wildcard "*" works for custom schemes
• Specific custom-scheme origins are rejected
• Error message is unclear about the root cause

OpenClaw version

2026.03.13

Operating system

macOS 26.3.1 (Remote control node) / Ubuntu 22.04.5 (Gateway)

Install method

npm global

Model

kimi-k2.5

Provider / routing chain

ws connection request -> main gateway server -> ws-connection -> checkBrowserOrigin

Config file / key location

No response

Additional provider/model setup details

No response

Logs, screenshots, and evidence

18:22:47 warn gateway/ws {"subsystem":"gateway/ws"} {"cause":"origin-mismatch","handshake":"failed","durationMs":277,"lastFrameType":"req","lastFrameMethod":"connect","lastFrameId":"108","host":"tardis.cloudforest-wezen.ts.net","origin":"tauri://localhost","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)","forwardedFor":"127.0.0.1","reason":"origin not allowed","client":"openclaw-control-ui","mode":"backend","version":"0.1.0"} closed before connect conn=17ff2555-702f-4c8a-8720-a6edf30ef4d4 remote=127.0.0.1 fwd=127.0.0.1 origin=tauri://localhost host=tardis.cloudforest-wezen.ts.net ua=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) code=1008 reason=origin not allowed (open the Control UI from the gateway host or allow it in gateway.controlUi.allowedOrigins)

Impact and severity

Impact

• Tauri/Electron desktop apps can't use proper origin allowlisting
• Gateway deployments are forced to choose between security and functionality

Additional information

Root Cause

parseOrigin() in src/gateway/origin-check.ts uses JavaScript's new URL() API, which only recognizes standard URL schemes (http, https, ws, wss, ftp, file). When it
encounters tauri://localhost, it throws an exception and returns null, causing validation to fail.

The wildcard works because it's checked before parsing: if (allowlist.has("*") || allowlist.has(parsedOrigin.origin))

Current Workaround

Use "*" in allowedOrigins, but this is a security regression.