openclaw - 💡(How to fix) Fix Gateway resets controlUi.allowedOrigins on every config reload, blocking external dashboards [9 comments, 5 participants]

openclaw2026-03-18 17:52:57

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#49950•Fetched 2026-04-08 01:00:52

View on GitHub

Comments

Participants

Timeline

Reactions

Author

Participants

Timeline (top)

commented ×9closed ×1cross-referenced ×1locked ×1

The OpenClaw gateway normalises gateway.controlUi.allowedOrigins on every config reload, resetting it to ["http://127.0.0.1:18789"] regardless of what was configured. This makes it impossible for external tools (Mission Control, custom dashboards) to connect via WebSocket.

Root Cause

Gateway's own Control UI blocked by its own origin check

When accessed via http://localhost:18789, the built-in Control UI is rejected because the config only allows http://127.0.0.1:18789 (localhost ≠ 127.0.0.1).

Code Example

"gateway": {
     "controlUi": {
       "allowedOrigins": ["http://127.0.0.1:3333", "*"]
     }
   }

RAW_BUFFERClick to expand / collapse

Description

Steps to Reproduce

Set custom allowed origins in ~/.openclaw/openclaw.json:

"gateway": {
  "controlUi": {
    "allowedOrigins": ["http://127.0.0.1:3333", "*"]
  }
}

Start the gateway: openclaw gateway run
Run any CLI command that touches the config, e.g.: openclaw models set nvidia/nemotron-3-super-120b-a12b
Check ~/.openclaw/openclaw.json — allowedOrigins has been reset to ["http://127.0.0.1:18789"]
Gateway detects config change, restarts, and rejects all origins except its own

Additional Issues

`dangerouslyDisableDeviceAuth` doesn't work

Setting gateway.controlUi.dangerouslyDisableDeviceAuth: true does not bypass device identity checks. The gateway still requires WebCrypto signing. Related: #25293, #1679

`dangerouslyAllowHostHeaderOriginFallback` stripped on reload

This setting is also removed when the config is rewritten by CLI commands.

`OPENCLAW_GATEWAY_ALLOWED_ORIGINS` env var ignored

Setting this environment variable has no effect on the gateway's origin checking.

Gateway's own Control UI blocked by its own origin check

When accessed via http://localhost:18789, the built-in Control UI is rejected because the config only allows http://127.0.0.1:18789 (localhost ≠ 127.0.0.1).

Expected Behaviour

Custom allowedOrigins should persist across config reloads
dangerouslyDisableDeviceAuth: true should actually disable device auth
An env var like OPENCLAW_GATEWAY_ALLOWED_ORIGINS should override the config
The gateway's own UI origin should always be implicitly allowed

Environment

OpenClaw 2026.3.11
Running inside NemoClaw/OpenShell sandbox on DGX Spark
Ubuntu 24.04, aarch64

Impact

This blocks all third-party dashboard integrations (Mission Control, custom monitoring tools) from connecting to the gateway WebSocket. The only UI that works is the gateway's own built-in Control UI accessed via the exact IP:port in the config.

extent analysis

Fix Plan

To address the issues with the OpenClaw gateway, follow these steps:

Modify the config handling code: Ensure that custom allowedOrigins persist across config reloads. This can be achieved by checking for existing values before overwriting the config.
Implement environment variable override: Use the OPENCLAW_GATEWAY_ALLOWED_ORIGINS environment variable to override the config. This can be done by adding a check for the environment variable before loading the config.
Fix device auth bypass: Update the dangerouslyDisableDeviceAuth logic to correctly bypass device identity checks.
Add implicit allowance for the gateway's own UI origin: Always allow the gateway's own UI origin, regardless of the config.

Example code snippets:

# Load config with custom allowed origins
if 'allowedOrigins' in config['gateway']['controlUi']:
    allowed_origins = config['gateway']['controlUi']['allowedOrigins']
else:
    allowed_origins = ["http://127.0.0.1:18789"]

# Override with environment variable
if 'OPENCLAW_GATEWAY_ALLOWED_ORIGINS' in os.environ:
    allowed_origins = os.environ['OPENCLAW_GATEWAY_ALLOWED_ORIGINS'].split(',')

# Bypass device auth if enabled
if config['gateway']['controlUi'].get('dangerouslyDisableDeviceAuth', False):
    # Disable device identity checks
    pass

# Implicitly allow the gateway's own UI origin
allowed_origins.append("http://localhost:18789")

Verification

To verify that the fix worked:

Set custom allowedOrigins in the config and restart the gateway.
Check that the custom allowedOrigins are still present after a config reload.
Test that external tools can connect via WebSocket.
Verify that dangerouslyDisableDeviceAuth correctly bypasses device identity checks.
Check that the gateway's own UI origin is implicitly allowed.

Extra Tips

Ensure that the OPENCLAW_GATEWAY_ALLOWED_ORIGINS environment variable is set correctly.
Test the fix in a non-production environment before deploying to production.
Consider adding additional logging to track config changes and origin checking.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

#api #ssr #installation #tensor shape #docker error #permission error #memory optimization #batch processing #environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Data

Security

Network

Code

UI/UX

Text

System

Multimedia

Protocol

API

Engineering

openclaw - 💡(How to fix) Fix Gateway resets controlUi.allowedOrigins on every config reload, blocking external dashboards [9 comments, 5 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Gateway's own Control UI blocked by its own origin check

Code Example

Description

Steps to Reproduce

Additional Issues

`dangerouslyDisableDeviceAuth` doesn't work

`dangerouslyAllowHostHeaderOriginFallback` stripped on reload

`OPENCLAW_GATEWAY_ALLOWED_ORIGINS` env var ignored

Gateway's own Control UI blocked by its own origin check

Expected Behaviour

Environment

Impact

extent analysis

Fix Plan

Verification

Extra Tips

Still need to ship something?

TRENDING

openclaw - 💡(How to fix) Fix Gateway resets controlUi.allowedOrigins on every config reload, blocking external dashboards [9 comments, 5 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Gateway's own Control UI blocked by its own origin check

Code Example

Description

Steps to Reproduce

Additional Issues

dangerouslyDisableDeviceAuth doesn't work

dangerouslyAllowHostHeaderOriginFallback stripped on reload

OPENCLAW_GATEWAY_ALLOWED_ORIGINS env var ignored

Gateway's own Control UI blocked by its own origin check

Expected Behaviour

Environment

Impact

extent analysis

Fix Plan

Verification

Extra Tips

Still need to ship something?

RELATED_DISCOVERY

TRENDING

`dangerouslyDisableDeviceAuth` doesn't work

`dangerouslyAllowHostHeaderOriginFallback` stripped on reload

`OPENCLAW_GATEWAY_ALLOWED_ORIGINS` env var ignored