安全修复：1.密码哈希验证 2.移除硬编码凭据 3.JWT强密钥 4.CORS白名单

2026-04-19 19:20:12 +08:00
parent d00f41a120
commit 38eef97480
14 changed files with 111 additions and 53 deletions
@@ -9,7 +9,13 @@ const app = express();
 const PORT = process.env.PORT || 3002;

 // 中间件
-app.use(cors());
+const corsOptions = {
+  origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'],
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Authorization']
+};
+app.use(cors(corsOptions));
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));