Sea-Studio/MC_Report
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy

Browse Source
This commit is contained in:
canglan
2026-07-13 19:49:44 +08:00
parent bc16833a57
commit eed4591059
3 changed files with 31 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
backend/middleware/security.js
View File

@@ -116,10 +116,17 @@ function apiKeyGuard(req, res, next) {
if (p === '/api/health' || p.startsWith('/api/install')) return next();
const key = getApiKey();
if (!key) return next();
if (req.headers['x-api-key'] !== key) return res.status(401).json({ error: '无效的 API 密钥' });
if (!req.headers['x-api-key'] || req.headers['x-api-key'].length !== key.length) return res.status(401).json({ error: '无效的 API 密钥' });
if (!timingSafeEqual(req.headers['x-api-key'], key)) return res.status(401).json({ error: '无效的 API 密钥' });
next();
}
function timingSafeEqual(a, b) {
let diff = a.length ^ b.length;
for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
return diff === 0;
}
function methodGuard(allowed) {
return (req, res, next) => {
if (!allowed.includes(req.method)) {