chengcheng/easyai
1
0
Fork 0
forked from wangbo/easyai
Code Pull Requests Activity

fix(deploy): 跨域来源未配置时默认放行

Browse Source
This commit is contained in:
wangbo
2026-09-27 18:00:03 +08:00
parent a00ee10b37
commit 89cc554c04
12 changed files with 62 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/Initialize-SecurityOrigin.ps1
+22 -16
View File
@@ -1,4 +1,4 @@
# 升级旧部署时从公开 API 地址补齐浏览器来源，并校验显式配置。
# 浏览器来源为可选项：缺失或留空时保持宽松策略，显式配置时校验。
. (Join-Path $PSScriptRoot "Initialize-PublicApiBaseUrl.ps1")
function Initialize-SecurityOrigin {
@@ -7,26 +7,32 @@ function Initialize-SecurityOrigin {
$content = Get-Content $Path -Raw -Encoding UTF8
if ($null -eq $content) { $content = "" }
$apiUrl = Get-PublicEnvValue $content "CONFIG_PUBLIC_API_BASE_URL"
if (-not (ConvertTo-PublicApiBaseUrl $apiUrl)) {
throw "Configure a valid CONFIG_PUBLIC_API_BASE_URL first"
}
$apiUri = [Uri]$apiUrl
$derived = $apiUri.GetLeftPart([UriPartial]::Authority)
$current = Get-PublicEnvValue $content "CONFIG_SECURITY_ORIGIN"
if (-not $current -or
($current -eq "http://127.0.0.1,http://localhost" -and $derived -ne "http://127.0.0.1")) {
$content = Set-PublicEnvValue $content "CONFIG_SECURITY_ORIGIN" $derived
[System.IO.File]::WriteAllText(
(Resolve-Path $Path),
$content,
[System.Text.UTF8Encoding]::new($false)
)
Write-Host " [OK] Browser origin: $derived" -ForegroundColor Green
if (-not $current) {
Write-Host " [OK] Browser origin is not configured; backend allows all origins" -ForegroundColor Green
return
}
# The legacy sample value was not a user-selected allowlist. Clear it on non-local upgrades.
if ($current -eq "http://127.0.0.1,http://localhost") {
$apiUrl = Get-PublicEnvValue $content "CONFIG_PUBLIC_API_BASE_URL"
$normalizedApiUrl = ConvertTo-PublicApiBaseUrl $apiUrl
if ($normalizedApiUrl) {
$derived = ([Uri]$normalizedApiUrl).GetLeftPart([UriPartial]::Authority)
if ($derived -notin @('http://127.0.0.1', 'http://localhost')) {
$content = Set-PublicEnvValue $content "CONFIG_SECURITY_ORIGIN" ""
[System.IO.File]::WriteAllText(
(Resolve-Path $Path),
$content,
[System.Text.UTF8Encoding]::new($false)
)
Write-Host " [OK] Cleared legacy browser-origin sample; backend allows all origins" -ForegroundColor Green
return
}
}
}
if ($current.StartsWith(',') -or $current.EndsWith(',') -or $current.Contains(',,')) {
throw "CONFIG_SECURITY_ORIGIN contains an empty origin"
}