xiongyuxing/gongxue-base
1
0
Fork 0
forked from wangziqi/gongxue-base
Code Pull Requests Activity

feat: enforce trusted session identity

Browse Source
This commit is contained in:
Codex
2026-06-28 21:56:11 +08:00
parent 1d873b2e50
commit 523b63c53b
23 changed files with 502 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.env.example
View File

@@ -40,5 +40,9 @@ AUTH_CODE_TTL_SECONDS=300
AUTH_SMS_COOLDOWN_SECONDS=60
AUTH_SESSION_TTL_SECONDS=604800
# 迁移期平台管理 API Key。生产环境应替换为平台管理员 JWT/服务端会话。
# 安全目标默认关闭迁移期身份头。仅本地兼容旧测试/旧前端时可临时设为 true。
ALLOW_LEGACY_AUTH_HEADERS=false
ALLOW_PLATFORM_ADMIN_KEY=false
# 迁移期平台管理 API Key。生产环境必须使用平台管理员 JWT/服务端会话，不能开启 ALLOW_PLATFORM_ADMIN_KEY。
PLATFORM_ADMIN_API_KEY=replace_with_platform_admin_key