Claw3D

mirror of https://github.com/iamlukethedev/Claw3D.git synced 2026-07-30 11:12:32 +00:00

Files

T

gsknnft dadcbbecbe hardening: drop unsafe-eval in production CSP; add TRUSTED_PROXY IP resolution

next.config.ts:
- unsafe-eval removed from production script-src (Next.js dev/HMR needs it, but
  production build does not; React and Three.js make no use of eval)
- connect-src intentionally kept broad with note: gateway URLs are user-configured
  at runtime, cannot be enumerated at build time

server/access-gate.js:
- Add resolveClientIp() helper: when TRUSTED_PROXY=1 env var is set, prefer the
  first value of X-Forwarded-For for rate-limiter keying (correct behavior behind
  nginx/Caddy/Vercel edge). Without the flag, remoteAddress is used (safe default
  for direct exposure — prevents X-Forwarded-For spoofing by untrusted clients).

Authored-By: GSKNNFT

2026-04-16 19:23:06 -04:00

access-gate.js

hardening: drop unsafe-eval in production CSP; add TRUSTED_PROXY IP resolution

2026-04-16 19:23:06 -04:00

demo-gateway-adapter.js

fix findings - bigger chatbox

2026-04-09 09:49:30 -04:00

gateway-proxy.js

feat(gateway): loopback bypass, control-ui remap, operator.read scope, 75ms connect

2026-04-16 16:20:33 -04:00

hermes-gateway-adapter.js

fix: clean up Hermes-visible OpenClaw leftovers (#97 )