From e2d7f004f8ffea843ee763b159830ef32e51766c Mon Sep 17 00:00:00 2001 From: root Date: Sun, 19 Apr 2026 19:36:58 +0800 Subject: [PATCH] =?UTF-8?q?feat:=20=E9=85=8D=E7=BD=AE=E5=86=85=E7=BD=91COR?= =?UTF-8?q?S=E6=94=AF=E6=8C=81=EF=BC=8C=E5=A1=AB=E5=86=99=E6=95=B0?= =?UTF-8?q?=E6=8D=AE=E5=BA=93=E5=AF=86=E7=A0=81=E5=92=8C=E8=85=BE=E8=AE=AF?= =?UTF-8?q?=E4=BA=91=E5=87=AD=E8=AF=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/api-complete.js | 18 ++++++++++++++++-- backend/app-simple.js | 18 ++++++++++++++++-- backend/app.js | 18 ++++++++++++++++-- backend/app_fixed.js | 18 ++++++++++++++++-- backend/final-backend.js | 18 ++++++++++++++++-- backend/production-server.js | 18 ++++++++++++++++-- backend/server-complete.js | 18 ++++++++++++++++-- 7 files changed, 112 insertions(+), 14 deletions(-) diff --git a/backend/api-complete.js b/backend/api-complete.js index 8557ed5..60915be 100644 --- a/backend/api-complete.js +++ b/backend/api-complete.js @@ -15,9 +15,23 @@ const imageFormats = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp', 'svg']; const app = express(); const PORT = process.argv[2] || process.env.PORT || 3000; -// 中间件 +// 中间件 - CORS配置（支持内网访问） +const corsWhitelist = process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001']; +const isPrivateIP = (origin) => { + if (!origin) return false; + try { + const host = new URL(origin).hostname; + return /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|localhost$)/.test(host); + } catch { return false; } +}; const corsOptions = { - origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'], + origin: (origin, callback) => { + if (!origin || corsWhitelist.includes(origin) || isPrivateIP(origin)) { + callback(null, true); + } else { + callback(null, true); // 内网使用，允许所有来源 + } + }, credentials: true, methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'], allowedHeaders: ['Content-Type', 'Authorization'] diff --git a/backend/app-simple.js b/backend/app-simple.js index 9b2c8b6..b70b981 100644 --- a/backend/app-simple.js +++ b/backend/app-simple.js @@ -8,9 +8,23 @@ dotenv.config(); const app = express(); const PORT = process.env.PORT || 3002; -// 中间件 +// 中间件 - CORS配置（支持内网访问） +const corsWhitelist = process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001']; +const isPrivateIP = (origin) => { + if (!origin) return false; + try { + const host = new URL(origin).hostname; + return /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|localhost$)/.test(host); + } catch { return false; } +}; const corsOptions = { - origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'], + origin: (origin, callback) => { + if (!origin || corsWhitelist.includes(origin) || isPrivateIP(origin)) { + callback(null, true); + } else { + callback(null, true); // 内网使用，允许所有来源 + } + }, credentials: true, methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'], allowedHeaders: ['Content-Type', 'Authorization'] diff --git a/backend/app.js b/backend/app.js index 8020cc5..f3922fa 100644 --- a/backend/app.js +++ b/backend/app.js @@ -8,9 +8,23 @@ dotenv.config(); const app = express(); const PORT = process.env.PORT || 3002; -// 中间件 +// 中间件 - CORS配置（支持内网访问） +const corsWhitelist = process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001']; +const isPrivateIP = (origin) => { + if (!origin) return false; + try { + const host = new URL(origin).hostname; + return /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|localhost$)/. test(host); + } catch { return false; } +}; const corsOptions = { - origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'], + origin: (origin, callback) => { + if (!origin || corsWhitelist.includes(origin) || isPrivateIP(origin)) { + callback(null, true); + } else { + callback(null, true); // 内网使用，允许所有来源 + } + }, credentials: true, methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'], allowedHeaders: ['Content-Type', 'Authorization'] diff --git a/backend/app_fixed.js b/backend/app_fixed.js index 050bdd3..fdebea5 100644 --- a/backend/app_fixed.js +++ b/backend/app_fixed.js @@ -8,9 +8,23 @@ dotenv.config(); const app = express(); const PORT = process.env.PORT || 3002; -// 中间件 +// 中间件 - CORS配置（支持内网访问） +const corsWhitelist = process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001']; +const isPrivateIP = (origin) => { + if (!origin) return false; + try { + const host = new URL(origin).hostname; + return /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|localhost$)/.test(host); + } catch { return false; } +}; const corsOptions = { - origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'], + origin: (origin, callback) => { + if (!origin || corsWhitelist.includes(origin) || isPrivateIP(origin)) { + callback(null, true); + } else { + callback(null, true); // 内网使用，允许所有来源 + } + }, credentials: true, methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'], allowedHeaders: ['Content-Type', 'Authorization'] diff --git a/backend/final-backend.js b/backend/final-backend.js index ebd33b9..cba0c2a 100644 --- a/backend/final-backend.js +++ b/backend/final-backend.js @@ -28,9 +28,23 @@ dotenv.config(); const app = express(); const PORT = process.env.PORT || 3002; -// 中间件 +// 中间件 - CORS配置（支持内网访问） +const corsWhitelist = process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001']; +const isPrivateIP = (origin) => { + if (!origin) return false; + try { + const host = new URL(origin).hostname; + return /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|localhost$)/.test(host); + } catch { return false; } +}; const corsOptions = { - origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'], + origin: (origin, callback) => { + if (!origin || corsWhitelist.includes(origin) || isPrivateIP(origin)) { + callback(null, true); + } else { + callback(null, true); // 内网使用，允许所有来源 + } + }, credentials: true, methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'], allowedHeaders: ['Content-Type', 'Authorization'] diff --git a/backend/production-server.js b/backend/production-server.js index a279eb7..78e3b36 100644 --- a/backend/production-server.js +++ b/backend/production-server.js @@ -9,9 +9,23 @@ const financeRouter = require('./finance-api'); const app = express(); const PORT = process.env.PORT || 5000; -// 中间件 +// 中间件 - CORS配置（支持内网访问） +const corsWhitelist = process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001']; +const isPrivateIP = (origin) => { + if (!origin) return false; + try { + const host = new URL(origin).hostname; + return /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|localhost$)/.test(host); + } catch { return false; } +}; const corsOptions = { - origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'], + origin: (origin, callback) => { + if (!origin || corsWhitelist.includes(origin) || isPrivateIP(origin)) { + callback(null, true); + } else { + callback(null, true); // 内网使用，允许所有来源 + } + }, credentials: true, methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'], allowedHeaders: ['Content-Type', 'Authorization'] diff --git a/backend/server-complete.js b/backend/server-complete.js index 7cbebe9..297a141 100644 --- a/backend/server-complete.js +++ b/backend/server-complete.js @@ -8,9 +8,23 @@ const db = require('./db'); const app = express(); const PORT = process.env.PORT || 3002; -// 中间件 +// 中间件 - CORS配置（支持内网访问） +const corsWhitelist = process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001']; +const isPrivateIP = (origin) => { + if (!origin) return false; + try { + const host = new URL(origin).hostname; + return /^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.|localhost$)/.test(host); + } catch { return false; } +}; const corsOptions = { - origin: process.env.CORS_ORIGIN ? process.env.CORS_ORIGIN.split(',') : ['http://localhost:5173', 'http://localhost:3001'], + origin: (origin, callback) => { + if (!origin || corsWhitelist.includes(origin) || isPrivateIP(origin)) { + callback(null, true); + } else { + callback(null, true); // 内网使用，允许所有来源 + } + }, credentials: true, methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'], allowedHeaders: ['Content-Type', 'Authorization']