fix: trust docker gateway IP for reverse proxy auth

dashboard/backend/routers/auth.py

@@ -113,8 +113,9 @@ async def login(creds: LoginRequest, request: Request):
 async def proxy_auth(request: Request):
     """Auto-login when Authelia has already authenticated the user via forward-auth.
     Caddy sets Remote-User header after successful Authelia 2FA verification."""
-    # Prevent IP spoofing: ensure proxy traffic is from localhost (Caddy)
-    if request.client.host not in ("127.0.0.1", "::1"):
+    # Prevent IP spoofing: ensure proxy traffic is from trusted proxy network
+    import config
+    if not config.is_trusted_proxy(request.client.host):
         logger.warning(f"Rejected proxy auth attempt from unauthorized IP: {request.client.host}")
         raise HTTPException(status_code=403, detail="Unauthorized proxy source")
 

dashboard/backend/routers/system.py

@@ -117,7 +117,8 @@ def _classify(method, path, status, user):
 @router.get("/openclaw-token")
 def openclaw_token(request: Request):
     ip = request.client.host
-    if ip in ("127.0.0.1", "::1"):
+    import config
+    if config.is_trusted_proxy(ip):
         forwarded = request.headers.get("x-forwarded-for", "").split(",")[0].strip()
         if forwarded:
             ip = forwarded