yunxiafei/openclaw-mission-control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,057 Commits 16 Branches 0 Tags
2519af2395f331bc0f79035d36042e17997a4108
Commit Graph

9 Commits

Author SHA1 Message Date
Abhimanyu Saharan
46bc9a02c6 fix(security): Keep short agent token prefixes in logs 
Restore the existing short token-prefix logging behavior for agent auth failures while keeping the optional bearer-path rate-limit fix. Update tests and docs so the replacement branch reflects the intended logging policy.

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-03-07 23:43:32 +05:30
Abhimanyu Saharan
fb8a932923 fix(security): Close review follow-up gaps 
Rate-limit the optional agent bearer path after user auth resolution so mixed user/agent routes no longer leave an unthrottled PBKDF2 path. Stop logging token prefixes on agent auth failures and require a locally supplied token for backend/.env.test instead of committing one.

Update tests and docs to cover agent bearer fallback, configurable webhook signature headers, and the operator-facing security settings added by the hardening work.

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-03-07 23:40:50 +05:30
Hugh Brown
494bf4649e docs: update api.md and authentication.md for Redis rate-limit backend and token logging 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 23:35:10 +05:30
Hugh Brown
81d16a324b docs: update security.md for Redis rate-limit backend and token logging 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 23:35:10 +05:30
Hugh Brown
84a5d8677e docs: update security.md to reflect current gateway token behavior 
The has_token redaction was reverted to avoid a frontend breaking
change. Update docs to match: tokens are currently returned in API
responses, redaction is planned for a future PR. Also note the
configurable payload size limit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 23:35:10 +05:30
Hugh Brown
acd1526acf docs: update api.md to reflect require_user_or_agent rename 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 23:35:10 +05:30
Hugh Brown
149fde90c4 docs: document security hardening changes from security review 
Add documentation for all user/operator-facing changes introduced by the
security review branch: rate limits, security headers, webhook HMAC
verification, payload size limits, gateway token redaction, non-root
containers, agent token logging, and prompt injection mitigation.

Updated: docs/reference/api.md, docs/reference/authentication.md,
docs/reference/configuration.md, docs/deployment/README.md,
docs/operations/README.md, docs/openclaw_gateway_ws.md, backend/README.md.
Created: docs/reference/security.md (consolidated security reference).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-07 23:35:10 +05:30
Abhimanyu Saharan
32e8855404 docs(api): document auth, request ids, errors, examples 2026-03-03 05:04:42 +05:30
Abhimanyu Saharan
1fdacec7c1 docs: add initial docs/ information architecture + stubs 2026-03-03 05:04:42 +05:30