weijuesen
51 lines
1.3 KiB
Go
51 lines
1.3 KiB
Go
package middleware
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
// CORS 跨域中间件，限制允许的来源、方法和头
|
|
func CORS() gin.HandlerFunc {
|
|
// 允许的来源：同源、本地开发、Tailscale 网段、局域网
|
|
allowedOrigins := []string{
|
|
"http://localhost:5174",
|
|
"http://localhost:3000",
|
|
"http://127.0.0.1:5174",
|
|
"http://127.0.0.1:3000",
|
|
}
|
|
|
|
isAllowed := func(origin string) bool {
|
|
for _, o := range allowedOrigins {
|
|
if origin == o {
|
|
return true
|
|
}
|
|
}
|
|
// 允许 Tailscale 100.x.x.x 和局域网 192.168.x.x 访问
|
|
if strings.HasPrefix(origin, "http://100.") || strings.HasPrefix(origin, "http://192.168.") ||
|
|
strings.HasPrefix(origin, "http://113.") || strings.HasPrefix(origin, "http://115.") {
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
return func(c *gin.Context) {
|
|
origin := c.GetHeader("Origin")
|
|
if origin != "" && isAllowed(origin) {
|
|
c.Header("Access-Control-Allow-Origin", origin)
|
|
c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
|
|
c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization, X-API-Key")
|
|
c.Header("Access-Control-Allow-Credentials", "true")
|
|
c.Header("Vary", "Origin")
|
|
}
|
|
|
|
if c.Request.Method == "OPTIONS" {
|
|
c.AbortWithStatus(204)
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
}
|