romtuck/openclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
961b4adc1c
openclaw/docs
History
Yuri Chukhlib 961b4adc1c
feat(gateway): deprecate query param hook token auth for security (#2200) 
* feat(gateway): deprecate query param hook token auth for security

Query parameter tokens appear in:
- Server access logs
- Browser history
- Referrer headers
- Network monitoring tools

This change adds a deprecation warning when tokens are provided via
query parameter, encouraging migration to header-based authentication
(Authorization: Bearer <token> or X-Clawdbot-Token header).

Changes:
- Modified extractHookToken to return { token, fromQuery } object
- Added deprecation warning in server-http.ts when fromQuery is true
- Updated tests to verify the new return type and fromQuery flag

Fixes #2148

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: deprecate hook query token auth (#2200) (thanks @YuriNachos)

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-01-26 14:51:25 +00:00
..
_layouts chore: normalize Clawdbot naming 2026-01-10 05:14:09 +01:00
assets docs: add X showcases 2026-01-13 04:41:01 +00:00
automation feat(gateway): deprecate query param hook token auth for security (#2200) 2026-01-26 14:51:25 +00:00
channels Docs: add LINE channel guide 2026-01-26 08:50:18 -06:00
cli fix: signal reactions 2026-01-25 03:24:44 +00:00
concepts fix: paragraph-aware newline chunking (#1726) 2026-01-25 13:24:19 +00:00
debug refactor: normalize cli command hints 2026-01-20 07:43:00 +00:00
diagnostics feat: add diagnostics flags 2026-01-25 10:40:27 +00:00
experiments feat(gateway): implement OpenResponses /v1/responses endpoint phase 2 2026-01-20 07:37:01 +00:00
gateway security: add mDNS discovery config to reduce information disclosure (#1882) 2026-01-26 13:32:11 +00:00
help docs: harden VPS install defaults 2026-01-26 13:04:18 +00:00
hooks test: expand soul-evil coverage 2026-01-18 06:39:26 +00:00
images docs: add group flow diagram 2026-01-10 20:05:22 +01:00
install docs: add Windows install troubleshooting 2026-01-25 05:48:24 +00:00
nodes docs: update media auto-detect 2026-01-23 05:47:16 +00:00
platforms docs: harden VPS install defaults 2026-01-26 13:04:18 +00:00
plugins refactor: align voice-call TTS with core config 2026-01-25 09:29:57 +00:00
providers Docs: add Claude Max API Proxy guide (#1875) 2026-01-25 22:32:38 -06:00
refactor fix: harden outbound mirroring normalization 2026-01-24 12:57:58 +00:00
reference chore: bump versions for 2026.1.25 2026-01-25 22:13:04 +00:00
start docs: clarify WSL2 recommendation 2026-01-25 02:30:09 +00:00
tools feat: audit fixes and documentation improvements (#1762) 2026-01-25 12:54:48 +00:00
web fix: require gateway auth by default 2026-01-26 12:56:33 +00:00
_config.yml refactor!: rename chat providers to channels 2026-01-13 08:40:39 +00:00
bedrock.md docs: add EC2 instance role setup for Bedrock (#1625) 2026-01-24 21:17:21 +00:00
brave-search.md refactor: split web tools and docs 2026-01-18 01:42:54 +00:00
broadcast-groups.md docs: complete channels rename sweep 2026-01-13 08:40:39 +00:00
CNAME chore: rename project to clawdbot 2026-01-04 14:38:51 +00:00
date-time.md perf: stabilize system prompt time 2026-01-24 06:24:04 +00:00
debugging.md docs: align node transport with gateway ws 2026-01-22 23:10:09 +00:00
docs.json Docs: add LINE channel guide 2026-01-26 08:50:18 -06:00
environment.md docs: consolidate faq under help 2026-01-24 09:49:38 +00:00
hooks.md docs: mention tool_result_persist hook 2026-01-20 09:36:10 +00:00
index.md fix: harden Mattermost plugin gating (#1428) (thanks @damoahdominic) 2026-01-23 01:23:23 +00:00
logging.md feat: add diagnostics flags 2026-01-25 10:40:27 +00:00
multi-agent-sandbox-tools.md feat: auto-recreate sandbox containers on config change 2026-01-19 01:35:27 +00:00
network.md docs: align node transport with gateway ws 2026-01-22 23:10:09 +00:00
perplexity.md fix: infer perplexity baseUrl from api key 2026-01-20 07:27:32 +00:00
plugin.md refactor: align voice-call TTS with core config 2026-01-25 09:29:57 +00:00
prose.md docs: fix lobster links 2026-01-23 02:51:33 +00:00
railway.mdx Update deployment link for Railway template 2026-01-25 13:42:56 -08:00
render.mdx Docs: add Render deployment guide (#1975) 2026-01-25 20:28:53 -06:00
scripts.md fix: add git hook setup and stable config hash sorting 2026-01-19 02:02:17 +00:00
testing.md Docs: frame skills eval gap in testing 2026-01-20 09:37:59 +00:00
token-use.md feat: add auth-aware cache defaults 2026-01-21 20:23:39 +00:00
tts.md TTS: gate auto audio on inbound voice notes (#1667) 2026-01-25 04:35:20 +00:00
tui.md docs: sweep support troubleshooting updates 2026-01-25 04:33:14 +00:00
vps.md docs: harden VPS install defaults 2026-01-26 13:04:18 +00:00
whatsapp-clawd.jpg Add WhatsApp screenshot to claude-config.md 2025-11-27 18:43:24 +01:00