chore: secure dashboard proxy endpoint and decouple lan checks

2026-02-27 23:41:36 +08:00
parent 29a9e9d881
commit 3888a57642
5 changed files with 57 additions and 14 deletions
@@ -116,7 +116,12 @@ def _classify(method, path, status, user):

@router.get("/openclaw-token")
 def openclaw_token(request: Request):
-    ip = request.headers.get("x-forwarded-for", "").split(",")[0].strip() or request.client.host
-    if not (ip.startswith("192.168.31.") or ip.startswith("100.")):
+    ip = request.client.host
+    if ip in ("127.0.0.1", "::1"):
+        forwarded = request.headers.get("x-forwarded-for", "").split(",")[0].strip()
+        if forwarded:
+            ip = forwarded
+    import config
+    if not config.is_lan_ip(ip):
        raise HTTPException(status_code=403, detail="Access denied")
    return {"token": OPENCLAW_GATEWAY_TOKEN}