设备配对令牌加固：改用 256-bit 随机 token 并保持常量时间校验

用于“担心配对 token 可预测或易被撞库”场景。前置：可升级 OpenClaw 并执行测试。步骤：升级到包含 PR #16535 的版本→确认 token 生成从 UUID 派生改为 `randomBytes(32).toString("base64url")`→保留 `safeEqualSecret` 常量时间比对→回归设备配对流程。关键命令：`openclaw gateway status`、`openclaw gateway restart`。验证：新 token 长度/格式稳定、错误 token 不会通过校验。风险：旧客户端若依赖历史 token 格式需兼容性验证。

GITHUBDiscovered 2026-02-15Author gumadeiras

Prerequisites

You can upgrade OpenClaw and restart gateway safely.
Device pairing flow is already in use and can be tested end-to-end.

Steps

Upgrade to a build that includes PR #16535 and restart gateway in a maintenance window.
Verify token generation now uses cryptographic randomness (`randomBytes(32)` + base64url).
Keep verification path on constant-time helper (`safeEqualSecret`) to avoid timing/multibyte mismatch pitfalls.
Run pairing regression: success with fresh token, fail with tampered token, and log outcomes.

Commands

openclaw gateway status

openclaw gateway restart

openclaw status

Verify

Pairing succeeds only with newly issued token; invalid/mutated token is consistently rejected without crash.

Caveats

Do not log raw pairing tokens in plaintext during debug sessions.
Client-side assumptions about token charset/length may require compatibility checks（需验证）.

Source attribution

This tip is aggregated from community/public sources and preserved with attribution.

Open original source ↗

Visit original post