安全加固：CORS白名单、JWT密钥自动生成、SSRF防护、路径遍历与错误信息泄露修复

2026-08-25 18:05:28 +08:00
parent c8fb93ff29
commit 338493ecaa
12 changed files with 168 additions and 31 deletions
@@ -49,8 +49,9 @@ def login():
                    return jsonify({'success': True, 'redirect': url_for('main.admin_page')})
                return redirect(url_for('main.admin_page'))
        except Exception as exc:
+            current_app.logger.error('[auth] login error: %s', exc, exc_info=True)
            if wants_json:
-                return jsonify({'success': False, 'error': str(exc)})
+                return jsonify({'success': False, 'error': '登录失败，请稍后重试'})
            return render_html('login.html', error='登录失败，请稍后重试')
        if wants_json:
            return jsonify({'success': False, 'error': '用户名或密码错误'})