admin/ComfyUI-OpenClaw
1
0
Fork 0
mirror of https://github.com/rookiestar28/ComfyUI-OpenClaw.git synced 2026-08-14 00:48:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: clarify LLM SSRF override parity

Browse Source
This commit is contained in:
rookiestar28
2026-03-14 17:58:54 +08:00
parent 2b0dd5d9a4
commit 9473a9e2e2
6 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2
View File
@@ -953,6 +953,7 @@ Notes:
- private/reserved IPs are still blocked even when present in `OPENCLAW_LLM_ALLOWED_HOSTS`
- `OPENCLAW_ALLOW_INSECURE_BASE_URL=1` is the explicit risk-acceptance override for HTTP or private/reserved IP targets (not recommended)
- wildcard entries such as `OPENCLAW_LLM_ALLOWED_HOSTS=*` are not supported
- the same contract applies at request time: `/openclaw/llm/models` refreshes and provider fetches honor the same explicit insecure override
- Local providers (`ollama`, `lmstudio`) are loopback-only by design:
- valid targets: `localhost` / `127.0.0.1` / `::1`
- do **not** enable `OPENCLAW_ALLOW_INSECURE_BASE_URL` just to use local LLM
@@ -1446,6 +1447,7 @@ python_embeded\python.exe -c "import os; print(repr(os.environ.get('OPENCLAW_LLM
Safer alternative:
- keep the LLM behind a reviewed public HTTPS reverse proxy and allowlist that public host, instead of enabling `OPENCLAW_ALLOW_INSECURE_BASE_URL`.
- on current builds, once that override is intentionally enabled and the process is restarted, both Remote Admin validation and `/openclaw/llm/models` should follow the same decision.
### Admin Token: server-side vs UI
docs/SECURITY.md
+1
View File
@@ -251,6 +251,7 @@ OpenClaw validates custom LLM `base_url` settings to prevent Server-Side Request
- `OPENCLAW_LLM_ALLOWED_HOSTS` only permits additional exact public hosts; it does not bypass the private/reserved-IP block.
- `OPENCLAW_ALLOW_ANY_PUBLIC_LLM_HOST=1` widens to any public host only.
- `OPENCLAW_ALLOW_INSECURE_BASE_URL=1` is the explicit risk-acceptance override for HTTP or private/reserved IP targets.
- the same override is enforced consistently for config validation, `/openclaw/llm/models`, and outbound provider requests.
- wildcard values such as `OPENCLAW_LLM_ALLOWED_HOSTS="*"` are not supported.
- avoid broad bypass flags in production (`OPENCLAW_ALLOW_ANY_PUBLIC_LLM_HOST`, `OPENCLAW_ALLOW_INSECURE_BASE_URL`).
docs/deploy/windows.md
+1
View File
@@ -67,6 +67,7 @@ If Remote Admin is running on this Windows host, but your custom/OpenAI-compatib
- `OPENCLAW_ALLOW_ANY_PUBLIC_LLM_HOST=1` still applies only to public hosts.
- Private/reserved LAN IPs still require `OPENCLAW_ALLOW_INSECURE_BASE_URL=1`.
- `OPENCLAW_LLM_ALLOWED_HOSTS=*` is not supported.
- On current builds, that same override is honored by both Remote Admin validation and `/openclaw/llm/models` refresh requests after a full restart.
Recommended verification in the same embedded runtime:
docs/release/api_contract.md
+1 -1
View File
@@ -107,7 +107,7 @@ Assist payload redaction contract:
| :--- | :--- | :--- | :--- | :--- |
| `POST` | `/chat` | `/moltbot/llm/chat` | Admin/Local | Unified chat interface for assistant interactions. |
| `POST` | `/test` | `/moltbot/llm/test` | Admin | Test LLM connectivity and configuration. |
| `GET` | `/models` | `/moltbot/llm/models` | Admin | List available models from configured provider. |
| `GET` | `/models` | `/moltbot/llm/models` | Admin | List available models from configured provider. Request-time fetch uses the same SSRF contract as saved `base_url` validation, including the explicit insecure override for private-IP/HTTP targets. |
### 1.4 Templates & Assets
docs/release/config_secrets_contract.md
+1
View File
@@ -64,6 +64,7 @@ Notes:
- Local providers (`ollama`, `lmstudio`) are loopback-only by design and should use `localhost` / `127.0.0.1` / `::1`.
- Local loopback provider targets do not require enabling insecure SSRF flags.
- `OPENCLAW_LLM_ALLOWED_HOSTS` does not allow private/reserved IPs; those still require `OPENCLAW_ALLOW_INSECURE_BASE_URL=1`.
- The same insecure override applies to config-save validation, `/openclaw/llm/models`, and outbound provider requests.
- Wildcard entries such as `*` are not supported in `OPENCLAW_LLM_ALLOWED_HOSTS`.
### 2.2 Security & Authentication
docs/security_deployment_guide.md
+9 -7
View File
@@ -114,11 +114,12 @@ OPENCLAW_ADMIN_TOKEN=change-this-local-admin-token
3. Keep external tools/registry sync/transforms disabled unless explicitly needed.
4. For local LLM providers (Ollama/LM Studio), use loopback URLs only (`localhost`/`127.0.0.1`/`::1`); keep `OPENCLAW_ALLOW_ANY_PUBLIC_LLM_HOST=0` and `OPENCLAW_ALLOW_INSECURE_BASE_URL=0`.
5. `OPENCLAW_LLM_ALLOWED_HOSTS` is only for additional exact public hosts; it does not permit RFC1918/private LAN targets.
6. Keep `OPENCLAW_DEBUG_REASONING_REVEAL=0` unless you are doing short-lived local admin debugging and explicitly need privileged reasoning reveal.
7. Keep `OPENCLAW_LOCALHOST_ALLOW_NO_ORIGIN=0` unless you explicitly need local CLI/no-origin compatibility.
8. Run:
6. The same LLM SSRF contract applies consistently to config validation, `/openclaw/llm/models`, and outbound provider requests.
7. Keep `OPENCLAW_DEBUG_REASONING_REVEAL=0` unless you are doing short-lived local admin debugging and explicitly need privileged reasoning reveal.
8. Keep `OPENCLAW_LOCALHOST_ALLOW_NO_ORIGIN=0` unless you explicitly need local CLI/no-origin compatibility.
9. Run:
- `python scripts/check_deployment_profile.py --profile local`
9. If you enable optional high-risk features, document why and time-box the change.
10. If you enable optional high-risk features, document why and time-box the change.
## 4. LAN (Trusted Subnet)
@@ -156,11 +157,12 @@ OPENCLAW_LOCALHOST_ALLOW_NO_ORIGIN=0
3. Keep bridge/tools/registry/transforms disabled unless there is a reviewed requirement.
4. Keep `OPENCLAW_LOCALHOST_ALLOW_NO_ORIGIN=0` for LAN deployments.
5. If your LLM is on another LAN/private-IP host, that still counts as an insecure `base_url` target; `OPENCLAW_LLM_ALLOWED_HOSTS` alone is not sufficient.
6. Run:
6. The same LLM SSRF contract applies consistently to config validation, `/openclaw/llm/models`, and outbound provider requests.
7. Run:
- `python scripts/check_deployment_profile.py --profile lan`
7. Run the security diagnostics endpoint before production use:
8. Run the security diagnostics endpoint before production use:
- `GET /openclaw/security/doctor` (admin boundary).
8. If using mobile/remote admin UI, expose `/openclaw/admin` only inside trusted LAN/VPN boundaries.
9. If using mobile/remote admin UI, expose `/openclaw/admin` only inside trusted LAN/VPN boundaries.
## 5. Public (Internet + Reverse Proxy)