fix: 同步改进CORS配置 - 始终包含生产域名

与main分支PR #93保持一致：无论CORS_ORIGINS_RAW环境变量是否设置，都确保 https://saas.xiaoxiajianji.com 在allow_origins中。
2026-06-28 21:59:39 +08:00
parent 2ee3992a94
commit 573e4485b7
6 changed files with 5 additions and 4 deletions
@@ -39,10 +39,11 @@ if settings.DEBUG:
    allow_origins = settings.CORS_ORIGINS  # Allow localhost in debug mode
 else:
    # In production, filter out any wildcard "*" origins
-    allow_origins = [origin for origin in settings.CORS_ORIGINS if origin != "*"]
-    if not allow_origins:
-        # Default to production domains if no valid origins configured
-        allow_origins = ["https://xiaoxiajianji.com", "https://saas.xiaoxiajianji.com"]
+    allow_origins = list({origin for origin in settings.CORS_ORIGINS if origin != "*"})
+    # Always ensure production domains are included
+    for domain in ("https://xiaoxiajianji.com", "https://saas.xiaoxiajianji.com"):
+        if domain not in allow_origins:
+            allow_origins.append(domain)

 app.add_middleware(
    CORSMiddleware,