feat: 修复 WebSocket 越权与 AI 流 SSRF

2026-08-14 00:45:22 +08:00
parent 1a29def480
commit 839ba91354
17 changed files with 614 additions and 136 deletions
@@ -501,6 +501,7 @@ C:\msys64\usr\bin\sshpass.exe -p "pan" C:\msys64\usr\bin\ssh.exe -o StrictHostKe
 | `PG` | `postgresql://postgres:pan@localhost:5432/silk` | PostgreSQL 连接串 |
 | `APP_ENV` | `development` | 运行环境；生产环境应设为 `production` |
 | `ALLOW_DEV_AUTOMIGRATE` | `false` | 仅开发环境可显式开启 AutoMigrate，生产忽略此开关 |
+| `WS_ALLOWED_ORIGINS` | `http://localhost:5174,http://localhost:3000,...` | WebSocket 允许的 Origin，逗号分隔 |
 | `REDIS` | `redis://:pan@localhost:6379` | Valkey/Redis 连接串 |
 | `JWT_SECRET` | `silk-secret-please-change-me` | JWT 签名密钥 |
 | `JWT_EXPIRES_IN` | `2h` | JWT 有效期 |