From d1cfd849c6a61800dcd86ffb45f80882ae20b2e7 Mon Sep 17 00:00:00 2001
From: zhizhijie <zhizhijie@users.noreply.gitee.com>
Date: 星期一, 14 九月 2026 22:32:36 +0800
Subject: [PATCH] security: 接口鉴权 + 跨域收紧 + AI 数据脱敏 + 日志脱敏
---
traffic-audit-server/src/main/java/com/trafficaudit/common/config/CorsConfig.java | 38 +++++++++++++++++++++++++++++++-------
1 files changed, 31 insertions(+), 7 deletions(-)
diff --git a/traffic-audit-server/src/main/java/com/trafficaudit/common/config/CorsConfig.java b/traffic-audit-server/src/main/java/com/trafficaudit/common/config/CorsConfig.java
index a1093fc..60d9193 100644
--- a/traffic-audit-server/src/main/java/com/trafficaudit/common/config/CorsConfig.java
+++ b/traffic-audit-server/src/main/java/com/trafficaudit/common/config/CorsConfig.java
@@ -1,22 +1,46 @@
package com.trafficaudit.common.config;
+import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * 璺ㄥ煙閰嶇疆锛氬彧鍏佽閰嶇疆涓垪鍑虹殑鏉ユ簮璁块棶鎺ュ彛銆�
+ * 鍓嶅悗绔垎绂绘湰鍦板紑鍙戦粯璁ゆ斁琛� 8080锛涘墠绔粡 dev-server 浠ｇ悊鎴栦笌鍚庣鍚屾簮閮ㄧ讲鏃跺潎涓嶉渶瑕侀澶栨斁琛屻��
+ * 娉ㄦ剰锛氫笉寮�鍚� allowCredentials锛堟帴鍙ｇ敤 Bearer 浠ょ墝閴存潈锛屼笉渚濊禆 Cookie锛夛紝閬垮厤浠绘剰绔欑偣鎼哄甫鍑瘉璋冪敤銆�
+ */
@Configuration
public class CorsConfig {
+
+ @Value("${app.cors.allowed-origins:http://localhost:8080,http://127.0.0.1:8080}")
+ private String allowedOrigins;
+
+ private List<String> originList() {
+ return Arrays.asList(allowedOrigins.split(","));
+ }
+
@Bean
- public CorsFilter corsFilter() {
+ public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration config = new CorsConfiguration();
- config.addAllowedOriginPattern("*");
- config.addAllowedHeader("*");
- config.addAllowedMethod("*");
- config.setAllowCredentials(true);
+ config.setAllowedOrigins(originList());
+ config.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type", "Accept", "X-Requested-With"));
+ config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
+ config.setAllowCredentials(false);
+ config.setMaxAge(3600L);
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", config);
- return new CorsFilter(source);
+ return source;
}
-}
+
+ @Bean
+ public CorsFilter corsFilter() {
+ return new CorsFilter(corsConfigurationSource());
+ }
+}
\ No newline at end of file
--
Gitblit v1.9.1