bonus
/
gz_safety_ma
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

修正csp，允许内网IP访问

This commit is contained in:
syruan 2025-10-27 14:58:17 +08:00
parent a23a89a7c2
commit e981d4e164
3 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/main/java/com/bonus/aqgqj/manager/common/config/CspFilter.java
View File

@ -21,6 +21,7 @@ public class CspFilter implements Filter {
"style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; " + "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; " +
"img-src 'self' data:; " + "img-src 'self' data:; " +
"font-src 'self' https://cdnjs.cloudflare.com; " + "font-src 'self' https://cdnjs.cloudflare.com; " +
"connect-src 'self' http://192.168.0.16:21520 http://127.0.0.1:21520 http://192.168.0.16:1999; " + // ✅ 允许 AJAX 请求你的后台接口
"form-action 'self';"; // 新增：限制表单仅提交到当前域名 "form-action 'self';"; // 新增：限制表单仅提交到当前域名
httpResponse.setHeader("Content-Security-Policy", cspPolicy); httpResponse.setHeader("Content-Security-Policy", cspPolicy);

1
src/main/java/com/bonus/aqgqj/manager/common/config/CspInterceptor.java
View File

@ -16,6 +16,7 @@ public class CspInterceptor implements HandlerInterceptor {
"style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; " + "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; " +
"img-src 'self' data:; " + "img-src 'self' data:; " +
"font-src 'self' https://cdnjs.cloudflare.com; " + "font-src 'self' https://cdnjs.cloudflare.com; " +
"connect-src 'self' http://192.168.0.16:21520 http://127.0.0.1:21520 http://192.168.0.16:1999; " + // ✅ 允许 AJAX 请求你的后台接口
"form-action 'self';"; "form-action 'self';";
response.setHeader("Content-Security-Policy", csp); response.setHeader("Content-Security-Policy", csp);
return true; return true;

2
src/main/java/com/bonus/aqgqj/manager/common/config/WebSecurityConfig.java
View File

@ -21,7 +21,7 @@ public class WebSecurityConfig implements WebMvcConfigurer {
// response.setHeader("X-Frame-Options", "SAMEORIGIN"); // response.setHeader("X-Frame-Options", "SAMEORIGIN");
// 补充 CSP 头（增强安全性，与 X-Frame-Options 配合） // 补充 CSP 头（增强安全性，与 X-Frame-Options 配合）
response.setHeader("Content-Security-Policy", "frame-ancestors 'none'"); // 禁止所有嵌入 response.setHeader("Content-Security-Policy", "frame-ancestors 'self'"); // 禁止所有嵌入
// 若允许同源：frame-ancestors 'self'; // 若允许同源：frame-ancestors 'self';
return true; return true;
} }