安全修复：1.密码哈希验证 2.移除硬编码凭据 3.JWT强密钥 4.CORS白名单

2026-04-19 19:20:12 +08:00
parent d00f41a120
commit 38eef97480
14 changed files with 111 additions and 53 deletions
@@ -1,7 +1,7 @@
 const jwt = require('jsonwebtoken');
 const { hashPassword, verifyPassword, verifyToken } = require('../utils/auth');

-const JWT_SECRET = process.env.JWT_SECRET || 'your-jwt-secret-change-in-production';
+const JWT_SECRET = process.env.JWT_SECRET;

 const generateToken = (user) => {
  const payload = {