mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-02 19:46:18 +00:00
ea967be0df
* feat(gateway): add loopback locality controls * fix(gateway): keep loopback auth delays enforced under concurrency The pending-timer cap let an attacker park cheap failures in every slot and then guess without penalty. Delays now key off a per-key deadline, so parallel guesses wait out the same escalating penalty and are still bounded by the max delay. * fix(gateway): share one loopback penalty timer per key Concurrent failures on a key now share a single timer and deadline instead of allocating one per in-flight request. Also corrects the security doc: the delay raises the cost of repeated guessing from one source, but credentials are compared before the failure response is delayed, so it is not a defense against parallel fan-out. * docs(gateway): record why loopback delay stays post-verification * docs: refresh generated docs map * docs: refresh plugin SDK API baseline * test: update loopback locality CI expectations |
||
|---|---|---|
| .. | ||
| audit-checks.md | ||
| dependency-locking.md | ||
| exposure-runbook.md | ||
| index.md | ||
| rate-limiting.md | ||
| secure-file-operations.md | ||