19 replies

Reverse Proxy headers are not trusted

Hi i am running openclaw in a docker container using docker-compose behind a (nginx) proxy

I ran the

security audit

security audit

and got this output:

OpenClaw security audit
Summary: 0 critical · 2 warn · 1 info
Run deeper: openclaw security audit --deep

WARN
gateway.trusted_proxies_missing Reverse proxy headers are not trusted
  gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.
  Fix: Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.

OpenClaw security audit
Summary: 0 critical · 2 warn · 1 info
Run deeper: openclaw security audit --deep

WARN
gateway.trusted_proxies_missing Reverse proxy headers are not trusted
  gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.
  Fix: Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.

according to the wiki there is a proxy config:
https://docs.openclaw.ai/gateway/security#reverse-proxy-configuration
but i dont know where to configure trustedProxies

FotC�

Friends of the Crustacean 🦞🤝•3w ago•

19 replies

stormy

Reverse Proxy headers are not trusted

Hi i am running openclaw in a docker container using docker-compose behind a (nginx) proxy

I ran the

security audit

security audit

and got this output:

OpenClaw security audit
Summary: 0 critical · 2 warn · 1 info
Run deeper: openclaw security audit --deep

WARN
gateway.trusted_proxies_missing Reverse proxy headers are not trusted
  gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.
  Fix: Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.

OpenClaw security audit
Summary: 0 critical · 2 warn · 1 info
Run deeper: openclaw security audit --deep

WARN
gateway.trusted_proxies_missing Reverse proxy headers are not trusted
  gateway.bind is loopback and gateway.trustedProxies is empty. If you expose the Control UI through a reverse proxy, configure trusted proxies so local-client checks cannot be spoofed.
  Fix: Set gateway.trustedProxies to your proxy IPs or keep the Control UI local-only.

according to the wiki there is a proxy config:
https://docs.openclaw.ai/gateway/security#reverse-proxy-configuration
but i dont know where to configure trustedProxies

Reverse Proxy headers are not trusted

Similar Threads

Reverse Proxy headers are not trusted

Similar Threads

Similar Threads

Similar Threads