安全加固：CORS白名单、JWT密钥自动生成、SSRF防护、路径遍历与错误信息泄露修复

backend/app.py

@@ -18,11 +18,28 @@ from blueprints.version import version_bp
 BASE_DIR = os.path.dirname(os.path.abspath(__file__))
 app = Flask(__name__, template_folder=BASE_DIR, static_folder=BASE_DIR)
 
-CORS(app)
+# CORS配置：限制为可信域名
+CORS(app, resources={
+    r"/api/*": {
+        "origins": [
+            "http://localhost:*",
+            "http://127.0.0.1:*",
+            "https://*.aishufu.top",
+            "http://*.aishufu.top"
+        ],
+        "methods": ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+        "allow_headers": ["Authorization", "Content-Type", "X-Requested-With", "X-Device-Id"],
+        "supports_credentials": True
+    }
+})
 app.secret_key = os.environ.get('SECRET_KEY', secrets.token_hex(32))
 app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=7)
 # 文件上传大小限制：2GB（数字人 ZIP 包等大文件）
 app.config['MAX_CONTENT_LENGTH'] = 2 * 1024 * 1024 * 1024
+# 会话安全配置
+app.config['SESSION_COOKIE_SECURE'] = os.environ.get('SESSION_COOKIE_SECURE', 'false').lower() == 'true'
+app.config['SESSION_COOKIE_HTTPONLY'] = True
+app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
 
 # 注册蓝图
 app.register_blueprint(auth)