优化客服云权限安全与访客IP解析

server/cmd/main.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"log"
+	"net/http"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -38,6 +39,7 @@ func main() {
 	}
 
 	// 启动 WebSocket Hub
+	ws.SetAllowedOrigins(cfg.AllowedOrigins)
 	go ws.DefaultHub.Run()
 
 	// 设置 Gin 模式
@@ -49,10 +51,25 @@ func main() {
 
 	// CORS
 	r.Use(func(c *gin.Context) {
-		c.Header("Access-Control-Allow-Origin", "*")
+		origin := c.GetHeader("Origin")
+		allowed := false
+		for _, candidate := range cfg.AllowedOrigins {
+			if candidate == "*" || candidate == origin {
+				allowed = true
+				break
+			}
+		}
+		if allowed && origin != "" {
+			c.Header("Access-Control-Allow-Origin", origin)
+			c.Header("Vary", "Origin")
+		}
 		c.Header("Access-Control-Allow-Methods", "GET,POST,PUT,DELETE,OPTIONS")
 		c.Header("Access-Control-Allow-Headers", "Content-Type,Authorization,X-Visitor-Token")
 		if c.Request.Method == "OPTIONS" {
+			if origin != "" && !allowed {
+				c.AbortWithStatus(http.StatusForbidden)
+				return
+			}
 			c.AbortWithStatus(204)
 			return
 		}