Critical Security Audit Issues – OpenClaw Configuration Help Needed
Hello,
I am currently facing some security audit issues in OpenClaw and I need assistance resolving them.
Security audit Summary: 1 critical · 1 warn · 1 info CRITICAL Non-loopback Control UI missing explicit allowed origins Control UI is enabled on a non-loopback bind but gateway.controlUi.allowedOrigins is empty. Strict origin policy requires explicit allowed origins for non-loop… Fix: Set gateway.controlUi.allowedOrigins to full trusted origins (for example https://control.example.com). If your deployment intentionally relies on Host-header origin fallback, set gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback=true. WARN No auth rate limiting configured gateway.bind is not loopback but no gateway.auth.rateLimit is configured. Without rate limiting, brute-force auth attacks are not mitigated. Fix: Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }). Full report: openclaw security audit Deep probe: openclaw security audit --deep
I previously had everything properly configured and working without issues. However, after updating to the latest version, this error began to appear.
I am currently facing some security audit issues in OpenClaw and I need assistance resolving them.
Security audit Summary: 1 critical · 1 warn · 1 info CRITICAL Non-loopback Control UI missing explicit allowed origins Control UI is enabled on a non-loopback bind but gateway.controlUi.allowedOrigins is empty. Strict origin policy requires explicit allowed origins for non-loop… Fix: Set gateway.controlUi.allowedOrigins to full trusted origins (for example https://control.example.com). If your deployment intentionally relies on Host-header origin fallback, set gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback=true. WARN No auth rate limiting configured gateway.bind is not loopback but no gateway.auth.rateLimit is configured. Without rate limiting, brute-force auth attacks are not mitigated. Fix: Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }). Full report: openclaw security audit Deep probe: openclaw security audit --deep
I previously had everything properly configured and working without issues. However, after updating to the latest version, this error began to appear.
The AI that actually does things. Emails, calendar, home automation - all from your favorite chat app. New shell, ready to help. The lobster way.
131,281Members
Resources
Similar Threads
Was this page helpful?
