CaIon
56dbaab1d4
- add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with startup validation: enabling Secure requires at least one trusted HTTPS entry URL - wire common.SessionCookieSecure into the session cookie store instead of a hardcoded Secure=false - print a startup warning when Secure session cookies are disabled - document the new settings in .env.example and docker-compose files Secure stays off by default because many deployments front new-api with plain-HTTP reverse proxies, where a hardcoded Secure default would break logins entirely; enabling it safely depends on the deployment's TLS setup, so it ships as an opt-in deployment-hardening flag.
24 lines
525 B
Go
24 lines
525 B
Go
package middleware
|
|
|
|
import (
|
|
"github.com/QuantumNous/new-api/common"
|
|
"github.com/gin-contrib/cors"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func CORS() gin.HandlerFunc {
|
|
config := cors.DefaultConfig()
|
|
config.AllowAllOrigins = true
|
|
config.AllowCredentials = true
|
|
config.AllowMethods = []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"}
|
|
config.AllowHeaders = []string{"*"}
|
|
return cors.New(config)
|
|
}
|
|
|
|
func Version() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
c.Header("X-New-Api-Version", common.Version)
|
|
c.Next()
|
|
}
|
|
}
|