modified: app/.env

modified:   app/ali_oss.py
	modified:   app/app.py
	new file:   app/blueprints/__pycache__/communication.cpython-39.pyc
	modified:   app/blueprints/communication.py
	modified:   app/brand_spider/__pycache__/main.cpython-39.pyc
	modified:   app/config.py
	modified:   app/main.py
	modified:   app/static/bg.jpg
	modified:   app/tool/__pycache__/devices.cpython-39.pyc
	modified:   app/web_source/brand.html
	modified:   app/web_source/templates_backup/brand.html

app/app.py

@@ -15,13 +15,24 @@ from blueprints.main import main_bp
 from blueprints.admin import admin_bp
 from blueprints.image import image_bp
 from blueprints.brand import brand_bp
+from blueprints.communication import communication_bp
 
 
 def create_app():
     app = Flask(__name__, template_folder=BASE_DIR, static_folder=BASE_DIR)
-    CORS(app)
-    app.secret_key = os.environ.get('SECRET_KEY', secrets.token_hex(32))
+    frontend_origin = os.environ.get('FRONTEND_ORIGIN', '*')
+    cors_origins = frontend_origin if frontend_origin != '*' else '*'
+    CORS(
+        app,
+        supports_credentials=True,
+        resources={r"/api/*": {"origins": cors_origins}, r"/login": {"origins": cors_origins}},
+    )
+    # 生产环境必须通过环境变量注入固定 SECRET_KEY；否则服务重启会使旧会话失效。
+    app.secret_key = os.environ.get('SECRET_KEY', 'dev-secret-key-change-me')
     app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=7)
+    app.config['SESSION_COOKIE_HTTPONLY'] = True
+    app.config['SESSION_COOKIE_SAMESITE'] = os.environ.get('SESSION_COOKIE_SAMESITE', 'Lax')
+    app.config['SESSION_COOKIE_SECURE'] = os.environ.get('SESSION_COOKIE_SECURE', '0') == '1'
 
     # 注册蓝图（不设 url_prefix，保持原有 URL 路径不变，前端无需改动）
     app.register_blueprint(auth_bp)
@@ -29,6 +40,7 @@ def create_app():
     app.register_blueprint(admin_bp)
     app.register_blueprint(image_bp)
     app.register_blueprint(brand_bp)
+    app.register_blueprint(communication_bp)
 
     return app