From a8219a1c955a9bb84300a52944ab886c604a4512 Mon Sep 17 00:00:00 2001
From: Administrator <15274802129@163.com>
Date: Sun, 14 Jun 2026 16:54:52 +0800
Subject: [PATCH] fix(security): 修复CORS配置中的安全漏洞
---
src/main/java/cc/mrbird/febs/common/configure/WebMvcConfigure.java | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/main/java/cc/mrbird/febs/common/configure/WebMvcConfigure.java b/src/main/java/cc/mrbird/febs/common/configure/WebMvcConfigure.java
index 96ce4ef..f729211 100644
--- a/src/main/java/cc/mrbird/febs/common/configure/WebMvcConfigure.java
+++ b/src/main/java/cc/mrbird/febs/common/configure/WebMvcConfigure.java
@@ -33,7 +33,8 @@
registration.excludePathPatterns("/api/xcxPay/wxpayCallback");
registration.excludePathPatterns("/api/xcxPay/rechargeCallBack");
registration.excludePathPatterns("/api/xcxPay/fapiaoCallBack");
-// registration.excludePathPatterns("/api/fuPay/callback");
+ registration.excludePathPatterns("/api/fuPayReturn/callback");
+ registration.excludePathPatterns("/api/fuPayReturn/payment/callback");
registration.excludePathPatterns("/api/fuPay/notify");
// 添加Swagger UI相关路径
@@ -50,7 +51,6 @@
registry.addMapping("/**")//允许请求路径
.allowedOrigins("*")//表示允许所有网址发起跨域请求
.allowedMethods("POST", "GET", "PUT", "OPTIONS", "DELETE")//表示允许跨域请求的方法
- .maxAge(3600)//表示在3600秒内不需要再发送预校验请求
- .allowCredentials(true);//允许客户端携带验证信息，即允许携带cookie
+ .maxAge(3600);//表示在3600秒内不需要再发送预校验请求
}
}
--
Gitblit v1.9.1