xiongyuxing/gongxue-base
1
0
Fork 0
forked from wangziqi/gongxue-base
Code Pull Requests Activity

feat: enforce trusted session identity

Browse Source
This commit is contained in:
Codex
2026-06-28 21:56:11 +08:00
parent 1d873b2e50
commit 523b63c53b
23 changed files with 502 additions and 201 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
apps/api/.env.example
View File

@@ -4,3 +4,10 @@ DEFAULT_TENANT_SLUG=master
CORS_ORIGIN=http://127.0.0.1:5173,http://localhost:5173
MAX_JSON_BODY_BYTES=1048576
MAX_IMPORT_JSON_BODY_BYTES=10485760
AUTH_SMS_PROVIDER=mock
AUTH_CODE_PEPPER=replace_with_a_long_random_secret
AUTH_SESSION_SECRET=replace_with_another_long_random_secret
# 安全目标默认关闭迁移期身份头。仅本地兼容旧测试/旧前端时可临时设为 true。
ALLOW_LEGACY_AUTH_HEADERS=false
ALLOW_PLATFORM_ADMIN_KEY=false
PLATFORM_ADMIN_API_KEY=replace_with_platform_admin_key