feat(app): 加可配置的 CORS 中间件 - #140
Closed
johnnyzhang-eng wants to merge 2 commits into
Closed
Conversation
…h the API 没有这个中间件,浏览器会把前端的每一个请求都拦在预检那一步: OPTIONS 返回 405、响应无 access-control-* 头,而后端日志里连请求都看不到 ——现场极易被误判成后端挂了。 - 来源由 WINDUP_CORS_ORIGINS 覆盖,默认值含 4173(vite preview,本地看真实 生产构建走这个端口)、5173(dev server)、3000 - 预览域名走 WINDUP_CORS_ORIGIN_REGEX 显式配置,**默认不开**:这里同时开了 allow_credentials,写死一条平台通配正则等于把带凭证的跨域请求放行给该平台上 任意第三方应用,且显式配了 WINDUP_CORS_ORIGINS 也关不掉它 四条断言进 CI。已用摘掉中间件的控制样本验证:其中三条在没有中间件时确实失败 (configured origin 拿到 405、4173 无放行头、regex 不生效),第四条是护栏断言。 Refs 1024XEngineer#139 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
johnnyzhang-eng
pushed a commit
to johnnyzhang-eng/game-asset-character
that referenced
this pull request
Aug 6, 2026
…l probe 让 main 上的后端能一条命令起在服务器上,并被容器健康检查正确判活。 本分支 stack 在 1024XEngineer#140(CORS)之上——两者都改 create_app(),1024XEngineer#140 合并后本分支 rebase。 - Dockerfile + docker-compose.yml:后端 + Postgres 一套起,uv sync --frozen 装依赖 - .dockerignore:构建上下文此前会带走 161MB 的本地虚拟环境 - GET /health 探针:HEALTHCHECK 原先打 /docs,而生产通常关掉交互文档 (docs_url=None),那时探针永远失败、容器被反复判死 - 声明 qiniu 依赖:media service 在函数体里延迟 import,不声明的话镜像能构建、 能启动、/docs 也正常,直到第一次 POST /media/upload 才 ModuleNotFoundError - README 补部署步骤与环境变量表 两条断言进 CI(find_spec("qiniu")、/health 可达)。 Refs 1024XEngineer#115 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
I found one security-sensitive CORS configuration edge case.
Verification: git diff --check 00c8d112e06290239db3707d907ffc87c38d5333...7bf9320fe4bcc2c31b284f25ac1e6fe6112f6ce0 passed. I could not run the Python tests or ruff in this container because pytest, fastapi, uv, and ruff are not installed.
minorcell
changed the title
minorcell
reviewed
Aug 6, 2026
Member
|
另外，注意到你的 agent 生成的内容整体偏口语化、像在聊天，工程感比较弱。 |
- allow_origins=["*"] + allow_credentials=False；鉴权走 Authorization 头不走 cookie - 删 _cors_origin_regex()，收窄入口保留 WINDUP_CORS_ORIGINS - 删 backend/tests/test_cors.py Refs 1024XEngineer#139 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Author
Contributor
Verification CompleteChecked the locked PR range What I verified:
Gates run in
Note: |
johnnyzhang-eng
pushed a commit
to johnnyzhang-eng/game-asset-character
that referenced
this pull request
Aug 6, 2026
…l probe 让 main 上的后端能一条命令起在服务器上,并被容器健康检查正确判活。 本分支 stack 在 1024XEngineer#140(CORS)之上——两者都改 create_app(),1024XEngineer#140 合并后本分支 rebase。 - Dockerfile + docker-compose.yml:后端 + Postgres 一套起,uv sync --frozen 装依赖 - .dockerignore:构建上下文此前会带走 161MB 的本地虚拟环境 - GET /health 探针:HEALTHCHECK 原先打 /docs,而生产通常关掉交互文档 (docs_url=None),那时探针永远失败、容器被反复判死 - 声明 qiniu 依赖:media service 在函数体里延迟 import,不声明的话镜像能构建、 能启动、/docs 也正常,直到第一次 POST /media/upload 才 ModuleNotFoundError - README 补部署步骤与环境变量表 两条断言进 CI(find_spec("qiniu")、/health 可达)。 Refs 1024XEngineer#115 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
变更内容
从 #115 拆出的 CORS 部分。只动
bootstrap/app.py，15 行。allow_origins/allow_methods/allow_headers=["*"]，开发阶段全放行allow_credentials=False。鉴权走Authorization: Bearer不走 cookie；CORS 规范禁止*与allow_credentials: true并存WINDUP_CORS_ORIGINS（逗号分隔）非空即覆盖，供部署收窄/health、Dockerfile、compose、README 部署章节在 #115。关联
Refs #139
本地验证
ruff check/lint-imports（2 kept, 0 broken）/pytest -q（1 passed）全过。preflight：默认任意来源放行且无
allow-credentials头；设WINDUP_CORS_ORIGINS后仅放行配置来源。