61 lines
1.9 KiB
Go
61 lines
1.9 KiB
Go
// Package middleware 提供 HTTP 中间件
|
|
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// CORS 跨域中间件
|
|
// - 白名单 origin 精确匹配（生产用）
|
|
// - 同时自动放行 http(s)://localhost:* 所有端口（开发期 Flutter Web/React Vite 随机端口）
|
|
// - 不在范围内的请求不设置 Allow-Origin 头，浏览器会自行阻止
|
|
func CORS(allowedOrigins []string) gin.HandlerFunc {
|
|
originSet := make(map[string]bool, len(allowedOrigins))
|
|
for _, o := range allowedOrigins {
|
|
originSet[strings.TrimRight(o, "/")] = true
|
|
}
|
|
|
|
return func(c *gin.Context) {
|
|
origin := strings.TrimRight(c.GetHeader("Origin"), "/")
|
|
if origin == "" {
|
|
c.Next()
|
|
return
|
|
}
|
|
|
|
// 是否允许：白名单精确匹配 或 localhost 通配
|
|
allowed := originSet[origin] || isLocalhostOrigin(origin)
|
|
|
|
if c.Request.Method == http.MethodOptions {
|
|
if allowed {
|
|
c.Writer.Header().Set("Access-Control-Allow-Origin", origin)
|
|
c.Writer.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
|
|
c.Writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Request-ID")
|
|
c.Writer.Header().Set("Access-Control-Expose-Headers", "X-Request-ID")
|
|
c.Writer.Header().Set("Access-Control-Max-Age", "86400")
|
|
c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
|
|
}
|
|
c.AbortWithStatus(http.StatusNoContent)
|
|
return
|
|
}
|
|
|
|
if allowed {
|
|
c.Writer.Header().Set("Access-Control-Allow-Origin", origin)
|
|
c.Writer.Header().Set("Vary", "Origin")
|
|
c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
}
|
|
|
|
// isLocalhostOrigin 匹配 http://localhost:* 和 http://127.0.0.1:*
|
|
// 开发期 Flutter Web / Vite / CRA 等工具常用随机端口
|
|
func isLocalhostOrigin(origin string) bool {
|
|
return strings.HasPrefix(origin, "http://localhost:") ||
|
|
strings.HasPrefix(origin, "http://127.0.0.1:") ||
|
|
strings.HasPrefix(origin, "http://[::1]:")
|
|
}
|