From fa6bf7aea276f59779cec59f1cad12d4a645a18b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=80=9Cwuzhen=E2=80=9D?= Date: Mon, 26 Oct 2026 15:19:04 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20=E6=81=A2=E5=A4=8D=20CORS=20?= =?UTF-8?q?=E9=80=9A=E9=85=8D=EF=BC=8C=E9=81=BF=E5=85=8D=E7=94=9F=E4=BA=A7?= =?UTF-8?q?=E5=9F=9F=E5=90=8D=E4=B8=8D=E5=8C=B9=E9=85=8D=E5=AF=BC=E8=87=B4?= =?UTF-8?q?=E6=95=B4=E7=AB=99=E6=97=A0=E6=B3=95=E8=AE=BF=E9=97=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Constraint: 优先恢复生产可用性，CORS 收紧可后续再按域名白名单做 Confidence: high Scope-risk: narrow Co-authored-by: Cursor --- backend/ruoyi-admin/src/main/resources/application.yml | 2 -- .../org/dromara/common/web/config/ResourcesConfig.java | 8 +++----- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/backend/ruoyi-admin/src/main/resources/application.yml b/backend/ruoyi-admin/src/main/resources/application.yml index 3e4be1dc..131ebc20 100644 --- a/backend/ruoyi-admin/src/main/resources/application.yml +++ b/backend/ruoyi-admin/src/main/resources/application.yml @@ -130,8 +130,6 @@ sa-token: # security配置 security: - # 允许跨域访问的来源（支持 * 通配子域名与 [*] 通配端口）；前端均经 nginx 同源访问 /prod-api，新增域名时在此补充 - cors-allowed-origins: "http://*.hzdyjsxy.cn:[*],https://*.hzdyjsxy.cn:[*],http://localhost:[*],http://127.0.0.1:[*]" # 排除路径（P0：已下线 Swagger/api-docs，不再加入白名单） excludes: - /*.html diff --git a/backend/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/ResourcesConfig.java b/backend/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/ResourcesConfig.java index cdfe1867..e3b022bd 100644 --- a/backend/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/ResourcesConfig.java +++ b/backend/ruoyi-common/ruoyi-common-web/src/main/java/org/dromara/common/web/config/ResourcesConfig.java @@ -1,7 +1,5 @@ package org.dromara.common.web.config; -import java.util.List; -import org.springframework.beans.factory.annotation.Value; import org.dromara.common.web.handler.GlobalExceptionHandler; import org.dromara.common.web.interceptor.PlusWebInvokeTimeInterceptor; import org.springframework.boot.autoconfigure.AutoConfiguration; @@ -35,11 +33,11 @@ public class ResourcesConfig implements WebMvcConfigurer { * 跨域配置 */ @Bean - public CorsFilter corsFilter(@Value("${security.cors-allowed-origins:http://localhost:[*],http://127.0.0.1:[*]}") List allowedOrigins) { + public CorsFilter corsFilter() { CorsConfiguration config = new CorsConfiguration(); config.setAllowCredentials(true); - // 设置访问源地址（仅允许配置的本校域名，禁止回显任意 Origin） - allowedOrigins.forEach(config::addAllowedOriginPattern); + // 设置访问源地址（恢复为原通配，避免生产域名/IP 不匹配导致整站接口被浏览器拦截） + config.addAllowedOriginPattern("*"); // 设置访问源请求头 config.addAllowedHeader("*"); // 设置访问源请求方法