From 3d8cf5250316003f67a27753b6002d9e3f1e7e84 Mon Sep 17 00:00:00 2001 From: qing <1776177662@qq.com> Date: Sat, 25 Jul 2026 10:22:58 +0800 Subject: [PATCH] =?UTF-8?q?=E7=99=BD=E5=90=8D=E5=8D=95=E5=9F=9F=E5=90=8D?= =?UTF-8?q?=EF=BC=9A=E7=A1=AC=E7=BC=96=E7=A0=81=20https://qs***.me=20?= =?UTF-8?q?=E3=80=81https://www.qs***.me=20=EF=BC=8C=E5=8A=A0=E4=B8=A4?= =?UTF-8?q?=E4=B8=AA=E6=9C=AC=E5=9C=B0=E5=BC=80=E5=8F=91=E5=9F=9F=E5=90=8D?= =?UTF-8?q?=EF=BC=88127.0.0.1:8443=E3=80=81localhost:8443=EF=BC=89?= =?UTF-8?q?=E3=80=82=20=E5=8A=A8=E6=80=81=E5=9B=9E=E5=A1=AB=20Origin?= =?UTF-8?q?=EF=BC=9A=E4=BB=85=E5=BD=93=E8=AF=B7=E6=B1=82=20Origin=20?= =?UTF-8?q?=E5=91=BD=E4=B8=AD=E7=99=BD=E5=90=8D=E5=8D=95=E6=97=B6=E6=89=8D?= =?UTF-8?q?=E8=AE=BE=E7=BD=AE=20Access-Control-Allow-Origin=EF=BC=8C?= =?UTF-8?q?=E5=90=A6=E5=88=99=E4=B8=8D=E8=BF=94=E5=9B=9E=E8=AF=A5=E5=A4=B4?= =?UTF-8?q?=EF=BC=88=E6=B5=8F=E8=A7=88=E5=99=A8=E4=BC=9A=E6=8B=92=E7=BB=9D?= =?UTF-8?q?=E8=B7=A8=E5=9F=9F=E8=AF=B7=E6=B1=82=EF=BC=89=E3=80=82=20?= =?UTF-8?q?=E8=BF=BD=E5=8A=A0=20Vary:=20Origin=EF=BC=9A=E5=91=8A=E8=AF=89?= =?UTF-8?q?=E7=BC=93=E5=AD=98=E8=AF=A5=E5=93=8D=E5=BA=94=E5=9B=A0=20Origin?= =?UTF-8?q?=20=E8=80=8C=E5=BC=82=EF=BC=8C=E9=81=BF=E5=85=8D=E7=BC=93?= =?UTF-8?q?=E5=AD=98=E8=AF=AF=E7=94=A8=E3=80=82=20=E7=A7=BB=E9=99=A4=20Acc?= =?UTF-8?q?ess-Control-Allow-Credentials:=20true=EF=BC=9A=E5=BD=93?= =?UTF-8?q?=E5=89=8D=E7=94=A8=20Bearer=20token=EF=BC=88=E8=AF=B7=E6=B1=82?= =?UTF-8?q?=E5=A4=B4=EF=BC=89=EF=BC=8C=E9=9D=9E=20cookie=EF=BC=8C=E4=B8=8D?= =?UTF-8?q?=E9=9C=80=E8=A6=81=E6=AD=A4=E5=A4=B4=EF=BC=9B=E4=BF=9D=E7=95=99?= =?UTF-8?q?=E5=8F=8D=E8=80=8C=E5=A2=9E=E5=8A=A0=E9=A3=8E=E9=99=A9=E9=9D=A2?= =?UTF-8?q?=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- gateway/src/main.cpp | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/gateway/src/main.cpp b/gateway/src/main.cpp index 8f1a462..9a0ae2d 100644 --- a/gateway/src/main.cpp +++ b/gateway/src/main.cpp @@ -506,7 +506,28 @@ void registerRoutes(HttpServer &server) { server.options("*", [](const auto& req, const auto& params) { pmc::net::http::response res; res.result(pmc::net::http::status::ok); - res.set(pmc::net::http::field::access_control_allow_origin, "*"); + + // CORS 白名单（P1-4）：仅允许官方域名，防止任意网站跨域调用 + // 原配置 Access-Control-Allow-Origin: * 过宽，XSS 拿到 token 后可跨域读取数据 + // 动态回填 Origin：仅当请求 Origin 命中白名单时才返回该值，否则不返回 ACAO 头 + static const std::vector allowed_origins = { + "https://qsont.me", + "https://www.qsont.me", + "http://127.0.0.1:8443", // 本地开发调试 + "http://localhost:8443" + }; + auto origin_it = req.base().find("Origin"); + if (origin_it != req.base().end()) { + std::string origin = std::string(origin_it->value()); + for (const auto& allowed : allowed_origins) { + if (origin == allowed) { + res.set(pmc::net::http::field::access_control_allow_origin, origin); + res.set(pmc::net::http::field::vary, "Origin"); + break; + } + } + } + res.set(pmc::net::http::field::access_control_allow_methods, "GET, POST, OPTIONS"); res.set(pmc::net::http::field::access_control_allow_headers, "Content-Type, Authorization"); res.set(pmc::net::http::field::access_control_max_age, "86400");