安全修复：1.密码哈希验证 2.移除硬编码凭据 3.JWT强密钥 4.CORS白名单

backend/final-backend.js

@@ -29,7 +29,13 @@ const app = express();
 const PORT = process.env.PORT || 3002;
 
 // 中间件
-app.use(cors());
+const corsOptions = {
+  origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'],
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Authorization']
+};
+app.use(cors(corsOptions));
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 
@@ -38,21 +44,21 @@ app.use(express.static(path.join(__dirname, '../frontend/dist')));
 
 // 用户相关 API
 // 获取用户列表
-
-// ==================== 认证路由 ====================
-const authRoutes = require('./routes/auth');
-app.use('/api/auth', authRoutes);
-
-
-// ==================== 用户路由 ====================
-const usersRoutes = require('./routes/users');
-app.use('/api/users', usersRoutes);
-
-
-// ==================== 商品路由 ====================
-const productsRoutes = require('./routes/products');
-app.use('/api/products', productsRoutes);
-
+
+// ==================== 认证路由 ====================
+const authRoutes = require('./routes/auth');
+app.use('/api/auth', authRoutes);
+
+
+// ==================== 用户路由 ====================
+const usersRoutes = require('./routes/users');
+app.use('/api/users', usersRoutes);
+
+
+// ==================== 商品路由 ====================
+const productsRoutes = require('./routes/products');
+app.use('/api/products', productsRoutes);
+
 
 // 创建供应商收款信息表
 async function createSupplierPaymentInfosTable() {