Grayscale/nanobot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(webui): require token_issue_secret for non-localhost bootstrap

Browse Source 
The previous LAN-access fix (PR #3656) relaxed the bootstrap localhost
check when host was 0.0.0.0, but did not require any authentication —
any device on the network could obtain a token without credentials.

New behavior:
- token_issue_secret configured: always validate, regardless of source
  IP (handles reverse-proxy scenarios where all connections appear as
  localhost).
- No secret configured: only localhost can bootstrap (local dev mode).

This supersedes the host-based check from PR #3656.
This commit is contained in:
chengyongru
2026-05-06 23:51:51 +08:00
committed by Xubin Ren
parent bad584cb0e
commit 034bea1a44
3 changed files with 63 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
webui/README.md
+5 -4
View File
@@ -74,7 +74,7 @@ NANOBOT_API_URL=http://127.0.0.1:9000 bun run dev
### Access from another device (LAN)
To use the webui from another device on the same network, set `host` to `"0.0.0.0"` in `~/.nanobot/config.json`:
To use the webui from another device on the same network, set `host` to `"0.0.0.0"` and configure `token_issue_secret` in `~/.nanobot/config.json`:
```json
{
@@ -82,15 +82,16 @@ To use the webui from another device on the same network, set `host` to `"0.0.0.
"websocket": {
"enabled": true,
"host": "0.0.0.0",
"port": 8765
"port": 8765,
"tokenIssueSecret": "your-secret-here"
}
}
}
```
Then open `http://<your-ip>:8765` on the other device. When `host` is `"0.0.0.0"`, the bootstrap endpoint accepts requests from any source instead of restricting to localhost.
Then open `http://<your-ip>:8765` on the other device. The bootstrap endpoint requires the secret via the `Authorization: Bearer <secret>` header (or `X-Nanobot-Auth`). Without a configured secret, only localhost connections can bootstrap.
> **Note:** This exposes the gateway to all interfaces. Only use on trusted networks.
> **Note:** This exposes the gateway to all interfaces. Always set `tokenIssueSecret` on non-local networks.
## Build for packaged runtime