openclaw - 💡(How to fix) Fix [Bug]: Trusted Proxy auth still requires device pairing

When gateway.auth.mode = "trusted-proxy" is active and the request passes trusted-proxy checks, Control UI WebSocket sessions can connect without device pairing identity.

---

{
  "gateway": {
    "mode": "local",
    "bind": "lan",
    "port": 18789,
    "trustedProxies": [
      "10.233.64.0/18"
    ],
    "nodes": {
      "pairing": {
        "autoApproveCidrs": [
          "10.233.64.0/18"
        ]
      }
    },
    "auth": {
      "mode": "trusted-proxy",
      "trustedProxy": {
        // Header containing authenticated user identity (required)
        "userHeader": "x-auth-request-email",
        // Optional: headers that MUST be present (proxy verification)
        "requiredHeaders": [
          "x-forwarded-proto",
          "x-forwarded-host"
        ],
        // Optional: restrict to specific users (empty = allow all)
        "allowUsers": [],
        // Optional: allow a same-host loopback proxy after explicit opt-in
        "allowLoopback": false
      }
    },
    "controlUi": {
      "enabled": true,
      "allowedOrigins": [
        "https://claw.example.com"
      ]
    }
  },
  "agents": {
    "defaults": {
      "workspace": "~/.openclaw/workspace"
    },
    "list": [
      {
        "id": "default",
        "name": "OpenClaw Assistant",
        "workspace": "~/.openclaw/workspace"
      }
    ]
  },
  "cron": {
    "enabled": false
  },
  "logging": {
    "level": "info"
  }
}

---

2026-05-29T04:34:09.313+00:00 [ws] closed before connect conn=218ee9d6-a470-4e9b-a8d3-06213244c668 peer=10.233.102.173:56310->10.233.101.173:18789 remote=10.233.102.173 fwd=10.13.1.100 origin=https://claw.example.com host=claw.example.com ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 code=1008 reason=pairing required: device is not approved yet (requestId: <request-id>)