fix(nginx): stop Control UI Bearer tokens from clobbering basic auth

[andrasbacsai]

Fixes #65

Replacement for #87. This branch merges @codezz's fix/control-ui-bearer-vs-basic-auth (head dcaa92bd) into current main with a merge commit, so @codezz's commits stay in the history. Please merge this PR with a merge commit, not squash or rebase. Squashing would drop dcaa92bd, and GitHub would not mark #87 as merged.

#87

What landed

@codezz fixed the repeated basic-auth prompt: the Control UI sends Authorization: Bearer, which replaces the browser's Basic credentials, and nginx answers 401 + WWW-Authenticate: Basic. nginx now skips basic auth only for the exact gateway routes that Bearer request is for, forwards the client's header, and does not append its own token= query parameter. /, the WebSocket, /rpc, and /browser/ stay on basic auth.

configure.js sets gateway.trustedProxies to 127.0.0.1 and ::1 when that list is not already set. nginx overwrites X-Forwarded-For with the TCP peer while basic auth is on, so OpenClaw's auth rate limit is not stuck on loopback. gateway.auth.mode stays token.

The merge onto current main was clean. Both sides are in the tree:

• allowed origins from COOLIFY_URL / COOLIFY_FQDN (fix: normalize Coolify FQDN for allowed origins #79)
• MiniMax (Refresh MiniMax provider for M3, M2.7, and M2.1 with configurable base URL #94)
• Ollama (fix(config): preserve custom Ollama models when OLLAMA_BASE_URL is set #96)
• OpenAI-compatible (feat(config): add OpenAI-compatible provider via OPENAI_COMPATIBLE_* env vars #95)
• the trusted-proxy default from fix(nginx): stop the Control UI Bearer token from clobbering basic auth #87

scripts/nginx-bearer.test.js builds its basic-auth password with crypto.randomBytes on each run, so the file no longer contains a password literal.

Tests

• node scripts/utils.test.js: 292 passed
• node scripts/nginx-bearer.test.js: 55 passed
• node scripts/smoke.js inside the image built from OPENCLAW_GIT_REF=v2026.10.5: openclaw ok: OpenClaw 2026.10.5 (1b58cb9)

Image build used Dockerfile.base then Dockerfile, same as CI. pnpm build && pnpm ui:build completed in one layer. The build log has no EXDEV.

With basic auth, Playwright loaded the Control UI, submitted the gateway token, and a one-time device approval connected the session. No browser dialog, and no 401 with WWW-Authenticate: Basic after the page loaded.

  

[gitguardian]

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
36526964	Triggered	Generic Password	dcaa92b	scripts/nginx-bearer.test.js	View secret
36526964	Triggered	Generic Password	7d742c6	scripts/nginx-bearer.test.js	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[batmanscode]

With basic auth, Playwright loaded the Control UI, submitted the gateway token, and a one-time device approval connected the session. No browser dialog, and no 401 with WWW-Authenticate: Basic after the page loaded.

Will this be needed everytime one logs into the control UI? i.e. need to always do the device approval

[codezz]

@batmanscode device approval should be done once, unless you clear cookies from what I tested

[batmanscode]

@batmanscode device approval should be done once, unless you clear cookies from what I tested

Thanks :D

Off the top of your head do you see a way for login via any browser (without cookie based device approval?)