Logan.Li
2c96902fbd
- CORS whitelist only allowed origin localhost:5173; browsers send Origin on same-origin POST too, so every deployment on any other port/origin got empty 403 on ALL POST/PUT/DELETE (curl tests masked it) - now echoes any origin (bearer-token auth, no cookie CSRF surface) - connection_tester pg DSN had a literal *** password placeholder - pg connection test and query path could never authenticate - instance detail endpoints (databases/tables/db-schema/table-detail) ran MySQL SHOW statements against pg - added pg branches (pg_database/pg_class/information_schema/pg_indexes, search_path semantics, PRI detection); schema filter uses non-system schemas - frontend normalizeDbType missed the literal 'postgresql' value so pg instances were treated as mysql (backtick quoting, no column hints); genSql no longer emits db.table prefix for pg (schema semantics) - also: query page footer warnings condensed to a single line per db type verified live: mysql table tree/context menu/preview-execute; pg table tree/columns/PK, double-click preview with masking working (email/phone masked), query history persisted
21 lines
622 B
Go
21 lines
622 B
Go
package middleware
|
|
|
|
import (
|
|
"github.com/gin-contrib/cors"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func CORSMiddleware() gin.HandlerFunc {
|
|
return cors.New(cors.Config{
|
|
// 内网运维平台:同源部署为主,开发端口不固定,按 Origin 回显放行
|
|
// (鉴权走 Bearer Token 不依赖 Cookie,CSRF 面可控)
|
|
AllowOriginFunc: func(origin string) bool {
|
|
return origin != ""
|
|
},
|
|
AllowMethods: []string{"GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"},
|
|
AllowHeaders: []string{"Origin", "Content-Type", "Authorization"},
|
|
ExposeHeaders: []string{"Content-Length"},
|
|
AllowCredentials: false,
|
|
})
|
|
}
|