fix(cors): require explicit allowed origins

2026-11-04 13:32:50 +08:00
parent 9ab7b10e3c
commit bd8c619bfb
5 changed files with 143 additions and 48 deletions
@@ -66,7 +66,7 @@ app.add_middleware(AuditMiddleware)
 # 确保这是你最后一个添加的 app.add_middleware
 app.add_middleware(
    CORSMiddleware,
-    allow_origins=["*"],  # 允许所有来源
+    allow_origins=settings.cors_allowed_origins,
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],