BCAI/easyai-ai-gateway
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(identity): 拒绝跨站浏览器会话端点

Browse Source 
统一认证使用 HttpOnly SameSite=Strict 会话 Cookie。配对时若 Public Base 与 Web Base 不属于同一 schemeful site，浏览器回调会丢失事务 Cookie。新增基于 Public Suffix List 的同站校验，并在运行时重建时重复门禁，防止旧持久化数据绕过。

验证：go test ./... -count=1（apps/api）
This commit is contained in:
chengcheng
2026-07-28 05:52:46 +08:00
parent 1b48a91af0
commit b51ecc5eed
5 changed files with 81 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/go.mod
+1
View File
@@ -15,6 +15,7 @@ require (
github.com/riverqueue/river/riverdriver/riverpgxv5 v0.24.0
github.com/riverqueue/river/rivertype v0.24.0
golang.org/x/crypto v0.52.0
golang.org/x/net v0.54.0
golang.org/x/oauth2 v0.36.0
)