Repository navigation
Make Web Bot Auth off unless WEB_BOT_AUTH=on - #775
Merged
Merged
Conversation
An OpenBot deployment is private by design, and a signed request names the deployment's URL to every site a Bot visits. Signing used to switch itself on whenever the public URL was https on a public address. Now it is only on when an operator sets WEB_BOT_AUTH=on (Helm: config.webBotAuth: "on"). The refusal of on with plain http or loopback stays, and a private https address is still accepted when switched on. The public/private address classification only existed to drive the automatic default, so it is gone. Docs, the chart README and values, .env.example and the Unreleased CHANGELOG now describe it as opt-in, and it drops out of Before upgrading because an upgrade no longer changes anything.
davidmckayv
requested review from
MikeRyanDev,
guidovizoso,
mxmzb and
tylerslaton
as code owners
October 12, 2026 22:00
1123786563
pushed a commit
to 1123786563/OpenBot
that referenced
this pull request
Oct 13, 2026
合入上游 14 个提交(CopilotKit#758-CopilotKit#778):sidebar Bots/Skills 重构、Bot 页面树 (bots.$agentId.*)、legacy 路由重定向、GitHub/Slack 账号链接(CopilotKit#763)、 memory-on-Intelligence 与默认开启(CopilotKit#773/CopilotKit#776)、Web Bot Auth(CopilotKit#775)、 headed 浏览器与住宅代理(CopilotKit#772)、admin 审计 CSV 导出(CopilotKit#751)、 v0.2.0(CopilotKit#768)等。 合并要点: - drizzle 迁移:上游 0053-0055 重编号为 0084-0086,快照按上游增量 叠加我方 0083 合成,journal 时间戳在 0083 后递增;0076 快照缺失 为合并前遗留,保持原样。 - createApp 尾参并入上游 identity/identityGithubCallback,两个按位 装配的测试(self-host-banner、identity-app-wiring)改为从尾部计数。 - UI 冲突取上游重写版;我方 i18n 键补进 settings/admin locale; billing/openConnector/craft/workshop/marketplace 全部保留。 - agent-computer/bun.lock 重装再生(web-bot-auth 依赖)。 - 删除上游已删的 agent-dialog/inbox/bots.$agentId 与遗留损坏的 mobile-links.test.ts。 验证:typecheck 全绿;vite build 通过;e2e 43/43(本地起服务); 迁移 journal/identity/billing 集成测试与合并前基线一致(无新增失败, 剩余失败均为合并前遗留或本机环境项:Appium 模拟器、VPN、日期腐化)。 Co-Authored-By: Claude Code <noreply@anthropic.com>
9 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OpenBot deployments are private by design. A signed request puts the deployment's URL in front of every site a Bot visits, so Web Bot Auth should never switch itself on.
Until now, leaving
WEB_BOT_AUTHunset turned it on whenever the public URL was https on a public address. With this change it is on only when an operator setsWEB_BOT_AUTH=on(on Helm,config.webBotAuth: "on").What changes
webBotAuthFromEnvreturns nothing unless the switch ison.onwith plain http, loopback or no public URL is still refused at start-up.onwith a private https address is still accepted.onrefusals and private-address acceptance are unchanged.docs/configuration.md,docs/architecture.md, the chart README andvalues.yaml, and.env.example.Checks
bun test tests/web-bot-auth.test.ts: 30 pass.helm lint charts/openbotall pass.