vidtheque.

read-only demo

Videos xg1zNlzw7Jk

Claws Out: Securing and Building with OpenClaw - Nick Taylor, Pomerium

index_state ready data_status ok

AI Engineer· published 2026-07-11· 0:17:11· en-US· indexed 2026-08-11 03:42

Open on YouTube

Scene timeline

  1. Shot 0, 0:00 to 0:05, 1 of 1 keyframes kept
  2. Shot 1, 0:05 to 0:09, 1 of 1 keyframes kept
  3. Shot 2, 0:09 to 0:14, 1 of 1 keyframes kept
  4. Shot 3, 0:14 to 0:17, 1 of 1 keyframes kept
  5. Shot 4, 0:17 to 0:44, 1 of 1 keyframes kept
  6. Shot 5, 0:44 to 0:53, 1 of 1 keyframes kept
  7. Shot 6, 0:53 to 1:07, 1 of 1 keyframes kept
  8. Shot 7, 1:07 to 1:52, 1 of 1 keyframes kept
  9. Shot 8, 1:52 to 2:21, 1 of 1 keyframes kept
  10. Shot 9, 2:21 to 2:49, 1 of 1 keyframes kept
  11. Shot 10, 2:49 to 2:57, 1 of 1 keyframes kept
  12. Shot 11, 2:57 to 3:07, 1 of 1 keyframes kept
  13. Shot 12, 3:07 to 3:46, 1 of 1 keyframes kept
  14. Shot 13, 3:46 to 3:59, 1 of 1 keyframes kept
  15. Shot 14, 3:59 to 4:34, 1 of 1 keyframes kept
  16. Shot 15, 4:34 to 5:08, 1 of 1 keyframes kept
  17. Shot 16, 5:08 to 5:28, 1 of 1 keyframes kept
  18. Shot 17, 5:28 to 6:02, 1 of 1 keyframes kept
  19. Shot 18, 6:02 to 6:06, 1 of 1 keyframes kept
  20. Shot 19, 6:06 to 6:30, 1 of 1 keyframes kept
  21. Shot 20, 6:30 to 6:38, 1 of 1 keyframes kept
  22. Shot 21, 6:38 to 6:50, 1 of 1 keyframes kept
  23. Shot 22, 6:50 to 7:05, 1 of 1 keyframes kept
  24. Shot 23, 7:05 to 7:31, 1 of 1 keyframes kept
  25. Shot 24, 7:31 to 7:58, 1 of 1 keyframes kept
  26. Shot 25, 7:58 to 8:36, 1 of 1 keyframes kept
  27. Shot 26, 8:36 to 8:44, 1 of 1 keyframes kept
  28. Shot 27, 8:44 to 8:46, 1 of 1 keyframes kept
  29. Shot 28, 8:46 to 8:48, 1 of 1 keyframes kept
  30. Shot 29, 8:48 to 8:50, 1 of 1 keyframes kept
  31. Shot 30, 8:50 to 9:22, 1 of 1 keyframes kept
  32. Shot 31, 9:22 to 9:23, 0 of 1 keyframes kept
  33. Shot 32, 9:23 to 9:25, 1 of 1 keyframes kept
  34. Shot 33, 9:25 to 9:48, 1 of 1 keyframes kept
  35. Shot 34, 9:48 to 10:12, 1 of 1 keyframes kept
  36. Shot 35, 10:12 to 10:23, 0 of 1 keyframes kept
  37. Shot 36, 10:23 to 10:51, 1 of 1 keyframes kept
  38. Shot 37, 10:51 to 10:54, 1 of 1 keyframes kept
  39. Shot 38, 10:54 to 11:19, 1 of 1 keyframes kept
  40. Shot 39, 11:19 to 11:44, 0 of 1 keyframes kept
  41. Shot 40, 11:44 to 12:09, 0 of 1 keyframes kept
  42. Shot 41, 12:09 to 12:25, 1 of 1 keyframes kept
  43. Shot 42, 12:25 to 12:58, 1 of 1 keyframes kept
  44. Shot 43, 12:58 to 12:59, 1 of 1 keyframes kept
  45. Shot 44, 12:59 to 13:46, 1 of 1 keyframes kept
  46. Shot 45, 13:46 to 14:12, 1 of 1 keyframes kept
  47. Shot 46, 14:12 to 14:14, 1 of 1 keyframes kept
  48. Shot 47, 14:14 to 14:26, 1 of 1 keyframes kept
  49. Shot 48, 14:26 to 14:43, 1 of 1 keyframes kept
  50. Shot 49, 14:43 to 15:00, 1 of 1 keyframes kept
  51. Shot 50, 15:00 to 15:13, 1 of 1 keyframes kept
  52. Shot 51, 15:13 to 16:02, 1 of 1 keyframes kept
  53. Shot 52, 16:02 to 16:18, 1 of 1 keyframes kept
  54. Shot 53, 16:18 to 16:54, 1 of 1 keyframes kept
  55. Shot 54, 16:54 to 16:57, 1 of 1 keyframes kept
  56. Shot 55, 16:57 to 17:10, 1 of 1 keyframes kept
  57. Shot 56, 17:10 to 17:11, 1 of 1 keyframes kept

57 shot(s).

keyframes kept every frame deduplicated

What was stored

cues
193
whisperx 193
chunks
30
from 193 cues
keyframes
53
kept of 57 captured
frames with text
52
2,706 lines read
chapters
0
from the source metadata
keyframe bytes
8.0 MB
word timings on 193 cues

Provenance

Each pipeline stage, its state and the model that produced it
stage state model started took
fetch done — 2026-08-11 03:38 1m 11s
stt done — 2026-08-11 03:39 18s
chunk done — 2026-08-11 03:39 0s
text_embed done — 2026-08-11 03:39 0s
keyframe done — 2026-08-11 03:39 1m 31s
ocr done — 2026-08-11 03:41 52s
frame_embed done — 2026-08-11 03:42 8s

Frames, and what the machine read

  • 0:02 #0 done2 line(s)

    shot 0·sharpness 667.3

    1. Al Engineer0.94
    2. EUROPE1.00

  • 0:06 #1 done2 line(s)

    shot 1·sharpness 825.0

    1. PRESENTINGSPONSOR1.00
    2. Google DeepMind1.00

  • 0:11 #2 done3 line(s)

    shot 2·sharpness 938.7

    1. PLATINUM SPONSORS0.98
    2. # Braintrust0.95
    3. WorkOS OpenAI0.95

  • 0:16 #3 done25 line(s)

    shot 3·sharpness 886.5

    1. Claw1.00
    2. AlEngineer0.95
    3. WorkOs0.88
    4. AlEngineel0.93
    5. EUROPE1.00
    6. EUROPE1.00
    7. SAFE1.00
    8. AlEngineer0.98
    9. Braintrust1.00
    10. INTELLIGENCE1.00
    11. EUROPE1.00
    12. WE1.00
    13. arize1.00
    14. AlEngineer0.99
    15. EUROPE1.00
    16. AlEngineer0.99
    17. EUROPE1.00
    18. PRESENTED BY1.00
    19. AlEngineer0.98
    20. Trigger.dev1.00
    21. Google DeepMind0.99
    22. EUROPE1.00
    23. Modal1.00
    24. AlEngineer0.94
    25. EUROPE1.00

  • 0:33 #4 done25 line(s)

    shot 4·sharpness 2691.5

    1. AlEngineer0.95
    2. Wor0.83
    3. EUROPE1.00
    4. About Me0.99
    5. SAFE1.00
    6. AIEngin0.95
    7. INTELLIGENCE1.00
    8. EUROPE1.00
    9. Developer Advocate at Pomerium1.00
    10. WE1.00
    11. ODEN0.99
    12. From Montreal, Quebec, Canada0.99
    13. AlEngineer1.00
    14. GitHub Star, MS MVP, AWS Community Builder0.99
    15. EUROPE1.00
    16. @nickytonline pretty much everywhere1.00
    17. PRESENTED BY1.00
    18. AlEngin0.90
    19. Google DeepMind1.00
    20. EUROPE1.00
    21. M1.00
    22. 00□0.60
    23. Google DeepMind0.99
    24. AlEngineer0.98
    25. EUROPE1.00

  • 0:49 #5 done15 line(s)

    shot 5·sharpness 2404.2

    1. About Me0.99
    2. Goo0.98
    3. pMind0.99
    4. Developer Advocate at Pomerium0.99
    5. From Montreal, Quebec, Canada1.00
    6. GitHub Star, MS MVP, AWS Community Builder0.99
    7. WE1.00
    8. @nickytonline pretty much everywhere1.00
    9. OPEN1.00
    10. 00□0.59
    11. AlEngineer0.98
    12. #Braintrust0.97
    13. WorkOS1.00
    14. OpenAl0.93
    15. EUROPE1.00

  • 0:55 #6 done9 line(s)

    shot 6·sharpness 1945.1

    1. Go0.97
    2. epMind0.98
    3. WE1.00
    4. OPEN1.00
    5. AlEngineer0.97
    6. Braintrust1.00
    7. WorkOS1.00
    8. OpenAl0.94
    9. EUROPE1.00

  • 1:30 #7 done29 line(s)

    shot 7·sharpness 2025.2

    1. [Feature]: Allow disabling auth with LAN binding for reverse proxy0.99
    2. setups #15601.00
    3. Closed1.00
    4. #159400.95
    5. Go0.99
    6. epMind1.00
    7. nickytonline opened on Jan 24 - edited by nickytonline0.99
    8. Edits0.92
    9. Contributor1.00
    10. Summary1.00
    11. I'm trying to secure Clawdbot with Pomerium (an Identity Aware Proxy). Full disclosure, I work at Pomerium. The proxy handles0.98
    12. authentication, so Clawdbot doesn't need its own auth.0.99
    13. But when I bind to LAN, Clawdbot forces token authentication. This breaks WebSocket connections because browsers can't1.00
    14. pass the token in WebSocket message payloads. The web Ul loads but shows "disconnected (1008): unauthorized* for all real-0.98
    15. OPEN1.00
    16. time features.1.00
    17. Proposed solution1.00
    18. Allow gateway.auth: "off" when gateway.bind: "lan" for reverse proxy scenarios.0.99
    19. Could add an explicit opt-in flag like:0.99
    20. gateway: {1.00
    21. bind: "lan",0.98
    22. auth: {0.96
    23. mode: "off",0.99
    24. allowUnauthenticatedProxy: true1.00
    25. This would only work when users explicitly opt in and understand they need a reverse proxy handling auth.1.00
    26. Alternatives considered1.00
    27. Google DeepMind0.99
    28. AlEngineer0.96
    29. EUROPE1.00

  • 1:56 #8 done46 line(s)

    shot 8·sharpness 2134.2

    1. AlEngineer0.94
    2. Wor0.88
    3. EUROPE1.00
    4. [Feature]: Allow disabling auth with LAN binding for reverse proxy0.99
    5. setups #15601.00
    6. SAFL0.98
    7. AlEngil0.86
    8. © Closed0.89
    9. 1#159400.98
    10. INTELLIGENC0.99
    11. EUROP1.00
    12. nickytonline opened on Jan 24 - edited by nickytonline0.99
    13. Edits1.00
    14. Contributor0.98
    15. WE1.00
    16. Summary1.00
    17. ODEN0.99
    18. ar1.00
    19. I'm trying to secure Clawdbot with Pomerium (an Identity Aware Proxy). Full disclosure, I work at Pomerium. The proxy handles0.99
    20. AlEngineer1.00
    21. authentication, so Clawdbot doesn't need its own auth.0.99
    22. EUROPE1.00
    23. pass the token in WebSocket message payloads. The web Ul loads but shows "disconnected (1008): unauthorized* for all real-0.99
    24. But when I bind to LAN, Clawdbot forces token authentication. This breaks WebSocket connections because browsers can't1.00
    25. PRESENTED BY1.00
    26. AlEngi0.96
    27. time features.1.00
    28. Google DeepMind0.98
    29. EUROP1.00
    30. Proposed solution1.00
    31. Allow gateway.auth: "off" when gateway.bind: "lan" for reverse proxy scenarios.0.99
    32. Could add an explicit opt-in flag like:1.00
    33. M1.00
    34. 50.56
    35. gateway: {0.99
    36. bind: "lan",0.97
    37. auth: {0.96
    38. mode: "off",0.99
    39. allowUnauthenticatedProxy: true1.00
    40. This would only work when users explicitly opt in and understand they need a reverse proxy handling auth.0.99
    41. Alternatives considered1.00
    42. AlEngineer0.97
    43. Braintrust1.00
    44. WorkOS1.00
    45. OpenAl0.93
    46. EUROPE1.00

  • 2:24 #9 done42 line(s)

    shot 9·sharpness 2208.6

    1. AlEngineer0.94
    2. Google De0.98
    3. EUROPE1.00
    4. [Feature]: Allow disabling auth with LAN binding for reverse proxy0.99
    5. setups #15601.00
    6. runp1.00
    7. AIEngii0.83
    8. Closed0.93
    9. 1#159400.99
    10. EUROP1.00
    11. nickytonline opened on Jan 24 - edited by nickytonline0.99
    12. Edits0.94
    13. Contributor1.00
    14. WE1.00
    15. OPEN1.00
    16. Trigg1.00
    17. Summary1.00
    18. I'm trying to secure Clawdbot with Pomerium (an Identity Aware Proxy). ull disclosure, I work at Pomerium. The proxy handles0.98
    19. AlEngineer0.99
    20. authentication, so Clawdbot doesn't need its own auth.0.99
    21. EUROPE1.00
    22. pass the token in WebSocket message payloads. The web Ul loads but shows "disconnected (1008): unauthorized* for all real-0.99
    23. But when I bind to LAN, Clawdbot forces token authentication. This breaks WebSocket connections because browsers can't1.00
    24. PRESENTED BY1.00
    25. AlEngi0.95
    26. time features.1.00
    27. Google DeepMind1.00
    28. EUROP1.00
    29. Proposed solution1.00
    30. Allow gateway.auth: "off" when gateway.bind: "lan" for reverse proxy scenarios.0.99
    31. Could add an explicit opt-in flag like:0.98
    32. CLOI0.98
    33. gateway: {1.00
    34. bind: "lan",0.98
    35. auth: {0.96
    36. mode: "off",1.00
    37. allowUnauthenticatedProxy: true1.00
    38. This would only work when users explicitly opt in and understand they need a reverse proxy handling auth.0.99
    39. Alternatives considered1.00
    40. Google DeepMind1.00
    41. AlEngineer0.97
    42. EUROPE1.00

  • 2:54 #10 done9 line(s)

    shot 10·sharpness 1924.4

    1. OS0.86
    2. marcwestermann on Jan 241.00
    3. PEN0.73
    4. I'd be interested in this too - I have a Caddy setup via tailscale and the gateway crashes after a0.99
    5. couple of minutes when exposed via this. Thank you@nickytonline1.00
    6. Braintrust1.00
    7. WorkOSOpenAI0.95
    8. AlEngineer0.97
    9. EUROPE1.00

  • 3:04 #11 done22 line(s)

    shot 11·sharpness 3562.0

    1. steipete on Jan 240.97
    2. Contributor1.00
    3. kOS0.89
    4. Hi Nick - yes I'd love if you could work on this. Just needs to be explicit - I don't want folks to leave gates open until they really0.99
    5. know what they're doing.0.98
    6. Here some codex notes1.00
    7. WE1.00
    8. Findings1.00
    9. OPEN1.00
    10. • Critical: core runtime guard explicitly rejects non-loopback binds when auth mode is none; change would be a deliberate0.99
    11. sOi0.70
    12. security regression and needs a new explicit override + audit/docs updates. src/gateway/server-runtime-config.ts:770.99
    13. src/security/audit.ts:2041.00
    14. • High: "auth off" does not bypass Control UI device identity on insecure HTTP; without allowlnsecureAuth +0.99
    15. token/password, the Ul is still blocked before auth is even checked. src/gateway/server/ ws-connection/message-0.99
    16. handler.ts:3011.00
    17. • Medium: 1008 "unauthorized" is triggered by the WS connect auth path; any proxy-only auth still needs a server-side trust0.99
    18. mechanism (headers or mTLS), otherwise it fails here. src/gateway/server/ws-connection/message-handler.ts:4940.99
    19. Questions/assumptions1.00
    20. Engineering the future of Al0.97
    21. AlEngineer0.98
    22. EUROPE1.00

  • 3:20 #12 done10 line(s)

    shot 12·sharpness 2473.0

    1. Prior to trusted proxy auth mode1.00
    2. rkos0.79
    3. Even if secured by a proxy (nginx, Caddy, Pomerium etc.), still had to0.99
    4. paste in an auth token in the Ul for websocket connections1.00
    5. Still had to pair for any new device1.00
    6. WE1.00
    7. OPEN1.00
    8. Google DeepMind0.99
    9. AlEngineer0.98
    10. EUROPE1.00

  • 3:53 #13 done26 line(s)

    shot 13·sharpness 1473.5

    1. steipete on Feb 141.00
    2. Contributor1.00
    3. Great work and clean PR!1.00
    4. kOS0.85
    5. fix: harden trusted-proxy auth follow-ups1.00
    6. 279d4b31.00
    7. E0.65
    8. steipete force-pushed the feat/trusted-prexy-auth branch from 8d158ac to 279d4b3 2 months ago0.99
    9. Compare1.00
    10. OPEN1.00
    11. steipete merged commit 1fb52b4 into openclaw: main on Feb 140.99
    12. View details1.00
    13. Revert1.00
    14. 13 checks passed1.00
    15. steipete on Feb 140.97
    16. Contributor1.00
    17. ...0.57
    18. Merged via squash.1.00
    19. • Prepared head SHA: 279d4b30.97
    20. · Merge commit: 1fb52b40.96
    21. Thanks@nickytonline!0.99
    22. AlEngineer0.99
    23. Braintrust1.00
    24. WorkOS1.00
    25. OpenAl0.94
    26. EUROPE1.00

  • 4:19 #14 done23 line(s)

    shot 14·sharpness 1286.5

    1. a/.openclaw/openclaw.json1.00
    2. +++ b/.openclaw/openclaw.json0.99
    3. @a -1,10 +1,17 @a0.90
    4. antrust0.96
    5. "gateway": {0.98
    6. "bind": "loopback",0.97
    7. "bind": "lan"0.99
    8. "trustedProxies": ["10.0.0.1"],0.99
    9. "auth": {0.97
    10. WE1.00
    11. "mode": "token",0.99
    12. OPEN1.00
    13. "token": "3a7f2e9b4c1d8e6a5f2b9c4e7d1a3f81.00
    14. SOIP0.82
    15. b6e9c2d4a5f7b8e9d1c3a4f6e8b2d9a"1.00
    16. "mode": "trusted-proxy",1.00
    17. "trustedProxy": {0.99
    18. "userHeader": "x-pomerium-claim-email"1.00
    19. "requiredHeaders": {1.00
    20. "x-pomerium-jwt-assertion": true0.99
    21. Google DeepMind1.00
    22. AlEngineer0.98
    23. EUROPE1.00

  • 4:54 #15 done37 line(s)

    shot 15·sharpness 1454.5

    1. AlEngineer0.98
    2. Brair0.94
    3. EUROPE1.00
    4. a/.openclaw/openclaw.json1.00
    5. +++ b/.openclaw/openclaw.json1.00
    6. @@ -1,10 +1,17 @a0.90
    7. Tess1.00
    8. AlEngir0.94
    9. EUROPI0.97
    10. "gateway": {0.96
    11. "bind": "loopback",0.99
    12. WE1.00
    13. "bind": "lan"0.99
    14. ODEN0.98
    15. Sno0.82
    16. "trustedProxies": ["10.0.0.1"],1.00
    17. AlEngineer0.97
    18. "auth": {0.97
    19. EUROPE1.00
    20. "mode": "token",0.99
    21. PRESENTED BY1.00
    22. AlEngir0.89
    23. "token": "3a7f2e9b4c1d8e6a5f2b9c4e7d1a3f80.99
    24. Google DeepMind1.00
    25. EUROPI1.00
    26. b6e9c2d4a5f7b8e9d1c3a4f6e8b2d9a"1.00
    27. "mode": "trusted-proxy",0.98
    28. "trustedProxy": {0.98
    29. Sc0.67
    30. "userHeader": "x-pomerium-claim-email"1.00
    31. "requiredHeaders": {0.99
    32. "x-pomerium-jwt-assertion": true1.00
    33. AlEngineer0.98
    34. # Braintrust0.96
    35. WorkOS1.00
    36. OpenAl0.93
    37. EUROPE1.00

  • 5:25 #16 done22 line(s)

    shot 16·sharpness 1913.0

    1. AlEngineer0.96
    2. Brair0.95
    3. EUROPE1.00
    4. With trusted proxy auth mode0.99
    5. Tess1.00
    6. AlEngir0.92
    7. EUROPI0.91
    8. No more token for web socket connections1.00
    9. WE1.00
    10. ODEN0.96
    11. Snc0.86
    12. No longer need to pair devices0.99
    13. AlEngineer0.97
    14. EUROPE1.00
    15. PRESENTED BY1.00
    16. AlEngir0.92
    17. Google DeepMind1.00
    18. EUROPI1.00
    19. Sc0.89
    20. Google DeepMind0.99
    21. AlEngineer0.98
    22. EUROPE1.00

  • 5:35 #17 done96 line(s)

    shot 17·sharpness 2727.2

    1. AlEngineer0.96
    2. Brair0.95
    3. EUROPE1.00
    4. openclaw / openclaw0.96
    5. 十0.89
    6. Tess1.00
    7. AlEngir0.91
    8. Code1.00
    9. Issues 5k+0.98
    10. Pull requests 5k+1.00
    11. Agents1.00
    12. Actions1.00
    13. Security and quality1.00
    14. 4691.00
    15. Insights1.00
    16. EUROPI0.97
    17. [Bug]: Control Ul ignores gateway.auth.mode:1.00
    18. New issue0.87
    19. "trusted-proxy" and always uses device1.00
    20. https://github.com/openclaw/openclaw/pul/254280.99
    21. 出☆0.61
    22. 00.54
    23. Chat0.89
    24. WE1.00
    25. pairing #252931.00
    26. openclaw / openclaw0.97
    27. n0.92
    28. ODEN0.97
    29. Sno0.80
    30. ©Closed0.94
    31. B Locked0.89
    32. 1#254280.85
    33. <> Code0.96
    34. Issues 5k+0.98
    35. I] Pull requests 5k+0.94
    36. Agents0.97
    37. Actions0.97
    38. ① Security and quality0.96
    39. 4691.00
    40. Insights1.00
    41. AlEngineer0.97
    42. anthony-spruyt opened on Feb 241.00
    43. Code -0.89
    44. EUROPE1.00
    45. Summary1.00
    46. fix(gateway): allow trusted-proxy control-ui auth to skip device1.00
    47. Google DeepMind1.00
    48. PRESENTED BY1.00
    49. AlEngir0.93
    50. EUROPI1.00
    51. trusted-proxy mode is configured with a valid user header and trusted0.98
    52. Control UI WebSocket connections bypass the configured0.98
    53. gateway.auth.mode and always use device pairing auth, even when0.99
    54. pairing #254280.99
    55. proxy CIDR.0.96
    56. Merged1.00
    57. by steipete openclaw:main Sid-Qin:fix/control-ui-trusted-proxy-skip--0.96
    58. Steps to reproduce1.00
    59. 1. Configure gateway with rusted-proxy auth behind a reverse proxy0.97
    60. Conversation 20.98
    61. -- Commits 20.96
    62. Checks 251.00
    63. 3 Files changed 40.91
    64. +48-50.95
    65. Sc0.78
    66. that injects a user header:0.98
    67. Sid-Qin on Feb 24 - edited0.96
    68. Contributor1.00
    69. Reviewers1.00
    70. "gateway": {0.90
    71. "auth": {0.89
    72. "node": "trusted-proxy",0.97
    73. Summary1.00
    74. gateway1.00
    75. size:S0.98
    76. Describe the problem and fix in 2-5 bullets:1.00
    77. Development1.00
    78. • Problem: Control Ul pairing bypass only checked sharedAuthok, but trusted-0.98
    79. [Bug]: Control Ul ignores gatewa...0.98
    80. proxy auth sets sharedAuth0k=false — so trusted-proxy users were0.97
    81. incorrectly forced through device pairing.1.00
    82. Notifications1.00
    83. Customize1.00
    84. • Why it matters: Users connecting via a trusted proxy could not access the0.98
    85. Control Ul without completing an unnecessary and confusing pairing step.0.99
    86. None0.99
    87. All0.93
    88. Status0.94
    89. • What changed: src/gateway/server/ws-connection/connect-policy.ts and0.99
    90. message-handler.ts now recognize trusted-proxy auth as a valid reason to1.00
    91. 2 participants1.00
    92. skip device pairing, alongside shared auth.0.98
    93. A00.56
    94. Google DeepMind1.00
    95. AlEngineer0.97
    96. EUROPE0.99

  • 6:04 #18 done84 line(s)

    shot 18·sharpness 2341.6

    1. 出户☆0.52
    2. openclaw / openclaw0.95
    3. Q0.89
    4. n0.97
    5. Code0.99
    6. Issues 5k+0.99
    7. Pull requests 5k+0.97
    8. Agents1.00
    9. Actions1.00
    10. Security and quality1.00
    11. 4690.99
    12. Insights1.00
    13. rust1.00
    14. [Bug]: Control Ul ignores gateway.auth.mode:1.00
    15. New issue0.98
    16. "trusted-proxy" and always uses device1.00
    17. https:/github.com/openclaw/openclaw/pul/254280.97
    18. 出Q☆0.60
    19. Chat0.98
    20. pairing #252930.99
    21. openclaw / openclaw0.97
    22. n0.88
    23. 日0.80
    24. © Closed0.87
    25. Locked0.95
    26. #254280.94
    27. <> Code0.93
    28. Issues 5k+0.93
    29. Il Pull requests 5k+0.98
    30. Agents0.95
    31. Actions0.95
    32. ① Security and quality0.94
    33. 4691.00
    34. Insights1.00
    35. anthony-spruyt opened on Feb 240.98
    36. Code0.95
    37. Summary1.00
    38. fix(gateway): allow trusted-proxy control-ui auth to skip device1.00
    39. OPEN0.99
    40. Control UI WebSocket connections bypass the configured0.99
    41. gateway.auth.mode and always use device pairing auth, even when0.99
    42. pairing #254280.99
    43. trusted-proxy mode is configured with a valid user header and trusted1.00
    44. proxy CIDR.0.95
    45. Merged1.00
    46. by steipete openclaw:mainSid-Qin:fix/control-ui-trusted-proxy-skip--0.96
    47. Steps to reproduce1.00
    48. 1. Configure gateway with trusted-proxy auth behind a reverse proxy0.98
    49. Conversation 20.99
    50. -- Commits 20.91
    51. Checks 250.96
    52. Files changed 40.95
    53. +48-50.95
    54. that injects a user header:1.00
    55. {0.69
    56. "gatewny": {0.91
    57. Sid-Qin on Feb 24 - edited0.97
    58. Contributor1.00
    59. Reviewers1.00
    60. "auth": (0.91
    61. "node": "trusted-proxy",0.97
    62. Summary1.00
    63. gateway1.00
    64. size:S0.94
    65. Describe the problem and fix in 2-5 bullets:1.00
    66. Development1.00
    67. • Problem: Control UI pairing bypass only checked sharedAuth0k, but trusted-0.98
    68. [Bug]: Control UI ignores gatewa...0.97
    69. proxy auth sets sharedAuth0k=false - so trusted-proxy users were0.98
    70. incorrectly forced through device pairing.1.00
    71. Notifications1.00
    72. Customize1.00
    73. • Why it matters: Users connecting via a trusted proxy could not access the0.98
    74. Control Ul without completing an unnecessary and confusing pairing step.0.99
    75. None0.97
    76. All0.95
    77. Status1.00
    78. • What changed: src/gateway/server/ws-connection/connect-policy.ts and0.99
    79. message-handler. ts now recognize trusted-proxy auth as a valid reason to0.99
    80. 2 participants1.00
    81. skip device pairing, alongside shared auth.1.00
    82. Engineering the future of Al1.00
    83. AlEngineer0.97
    84. EUROPE1.00

  • 6:25 #19 done21 line(s)

    shot 19·sharpness 2234.0

    1. O0.64
    2. openclaw / openclaw0.97
    3. Code1.00
    4. Issues1.00
    5. 5k+1.00
    6. Pull requests0.99
    7. 5k+1.00
    8. Agents1.00
    9. Actions1.00
    10. More1.00
    11. New issue1.00
    12. 凸□0.54
    13. d1.00
    14. PEN0.81
    15. [Feature]: Allow disabling auth with LAN binding for reverse1.00
    16. proxy setups #15600.97
    17. Closed1.00
    18. 8#159400.95
    19. Google DeepMind1.00
    20. AlEngineer0.99
    21. EUROPE1.00

  • 6:31 #20 done23 line(s)

    shot 20·sharpness 2299.4

    1. N binding for reverse0.98
    2. openclaw / openclaw0.99
    3. AlEngineer0.99
    4. SOURCE0.99
    5. Code1.00
    6. Issues1.00
    7. 5k+1.00
    8. Pull requests0.96
    9. 5k+1.00
    10. Agents1.00
    11. Actions1.00
    12. More1.00
    13. Hn0.51
    14. Googl DeepMind0.94
    15. New issue0.99
    16. □0.65
    17. [Feature]: Allow disabling auth with LAN binding for reverse1.00
    18. proxy seups #15601.00
    19. Closed1.00
    20. 8#159400.94
    21. Google DeepMind1.00
    22. AlEngineer0.98
    23. EUROPE1.00

  • 6:40 #21 done24 line(s)

    shot 21·sharpness 2154.2

    1. AI0.94
    2. 三0.93
    3. openclaw / openclaw0.97
    4. Q1.00
    5. Code1.00
    6. Issues1.00
    7. 5k+1.00
    8. Pull requests0.96
    9. 5k+1.00
    10. Agents1.00
    11. Actions1.00
    12. More1.00
    13. WE1.00
    14. New issue0.97
    15. OPEN1.00
    16. [Feature]: Allow disabling auth with LAN binding for reverse1.00
    17. proxy seups #15600.99
    18. Closed1.00
    19. 80#159400.95
    20. AlEngineer0.98
    21. Braintrust1.00
    22. WorkOS1.00
    23. OpenAI0.92
    24. EUROPE1.00

  • 6:53 #22 done5 line(s)

    shot 22·sharpness 1480.3

    1. Oper1.00
    2. WE1.00
    3. d0.68
    4. ODEN0.96
    5. McClaw1.00

  • 7:25 #23 done

    shot 23·sharpness 1797.8

The page's on-screen-text budget of 600 lines is spent, so the last cards in this grid list fewer lines than they hold. Narrow the page with ?frames= to read them.

Transcript

193 cues· 2,590 words· 13,222 chars

  1. 0:15 So, like Phil said, I work at Pomarium, and he's not the first person to have trouble pronouncing it, so I actually convinced the marketing team to create Pomeranian stickers, so if anybody wants Pomeranian stickers, I have a bunch with me.
  2. 0:31 A bit about me, I'm a dev advocate over at Pomarium, as Phil said.
  3. 0:35 I'm from Canada.
  4. 0:37 Halen from Montreal.
  5. 0:40 If anybody likes poutine and bagels, feel free to chat with me after.
  6. 0:44 Also a GitHub star, Microsoft MVP, and AWS Community Builder, and you can pretty much find me everywhere, at NickyTOnline.
  7. 0:55 I was pretty happy to see this, that there's a pretty sizable instance on-prem of OpenClaw, so I was pretty happy with that, and it looks like that's the operator there.
  8. 1:08 Cool.
  9. 1:09 So I don't know.
  10. 1:11 I came up with a funny title, I guess, but Claws Out.
  11. 1:14 We're going to talk about a feature I contributed to the Open Claw project back in February.
  12. 1:21 And it's about hardening access to the control plane.
  13. 1:24 So I'm assuming everybody here is running an Open Claw or Open Claw curious.
  14. 1:32 Is anybody running a mode called trusted proxy auth mode?
  15. 1:37 You might not be, but okay.
  16. 1:39 You might be on the, who's on the token auth?
  17. 1:41 Okay.
  18. 1:44 Anyways, so at Pomarium where I work, you know, I'm always just trying to secure things.
  19. 1:50 That's just part of what I do.
  20. 1:53 And I was able to secure Open Club, but it meant I still had to add a token for the WebSocket connection.
  21. 2:01 I had to always pair my device and stuff.
  22. 2:04 And you don't really need that with a trusted proxy, like specifically the one that I work on, which is OpenCore, it's called an identity-aware proxy.
  23. 2:14 So if anybody's ever used GCP, there's an IAP in there, it's called an identity-aware proxy, something that came out of Google.
  24. 2:22 Essentially, you've got an identity provider, a policy engine, and a reverse proxy, so those
  25. 2:28 It's not the lethal trifecta in the sense that you usually hear, but it's a pretty solid security approach for securing internal apps.
  26. 2:36 So I was like, of course, I kind of got annoyed that I had to add this token still and do the pairing every time.
  27. 2:44 I understood why they were there, but I just proposed this issue and then at least one other person who uses Caddy chimed in and said, hey, that sounds like a good idea.
  28. 2:57 And then Peter was like, yeah, let's work on this.
  29. 3:01 And he laid out the criteria that he wanted to have for this feature.
  30. 3:06 So I went ahead and worked on it.
  31. 3:09 And yeah, again, prior to trusted proxy auth mode, even if you were secured by a proxy, you still had to paste in that auth token in the UI for the WebSocket connection.
  32. 3:20 And also it sticks it in the query string, which obviously this is really more for just only local mode, really.
  33. 3:28 and still having to pair the device.
  34. 3:31 I don't know if people get annoyed by pairing the device, but I'd just be on my phone after I just set it up, and then I was like, I gotta go to the other thing to set it up.
  35. 3:41 Basically, you still had to do those things, even if it was secured with a proxy.
  36. 3:48 So, got merged in, and I felt pretty good about it.
  37. 3:54 Nice to get some praise from Peter.
  38. 3:55 It was my first contribution to the project.
  39. 3:59 It's very cool.
  40. 3:59 So what does it look like exactly like in the config?
  41. 4:03 I'm just gonna show like a kind of narrow part of the config here, but you have your gateway and essentially you no longer need the token like I mentioned.
  42. 4:14 The mode is obviously different so it's called trusted proxy now.
  43. 4:16 And then there's some new properties you have to add.
  44. 4:18 So there's trusted proxies and this is essentially the proxy that is gating access to the control plane, the gateway.
  45. 4:28 It's the IP addresses.
  46. 4:30 It could be one or more.
  47. 4:32 And aside from that, you have to have a trusted proxy section.
  48. 4:36 So you'll have a user header, which is, in my case, it's a JWT.
  49. 4:43 And then there's a required header section.
  50. 4:45 There's some optional ones, too.

Open at this second