open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2025-12-23 07:32:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

Address code review feedback: fix JWT regex and path construction

Browse Source 
Co-authored-by: whyour <22700758+whyour@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2025-12-22 14:51:49 +00:00
parent 10f19a5c1d
commit 0bae11def6
2 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
back/loaders/express.ts
View File

@ -30,8 +30,13 @@ export default ({ app }: { app: Application }) => {
// Create base-URL-aware whitelist for JWT
const jwtWhitelist = config.apiWhiteList.map(path => `${config.baseUrl}${path}`);
// Allow all paths that don't contain /api/ or /open/ to skip JWT
const jwtExcludeRegex = /^\/(?!.*\/(api|open)\/)/;
// Exclude non-API/non-open paths from JWT requirement
// When baseUrl is set: exclude paths that don't start with baseUrl/api/ or baseUrl/open/
// When baseUrl is empty: exclude paths that don't start with /api/ or /open/
const jwtExcludePattern = config.baseUrl
? `^(?!${config.baseUrl.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}/(api|open)/)`
: '^(?!/(api|open)/)';
const jwtExcludeRegex = new RegExp(jwtExcludePattern);
app.use(
expressjwt({
@ -79,7 +84,7 @@ export default ({ app }: { app: Application }) => {
}
}
const originPath = `${req.baseUrl}${req.path === '/' ? '' : req.path}`;
const originPath = `${config.baseUrl}${req.path === '/' ? '' : req.path}`;
if (
!headerToken &&
originPath &&

5
src/utils/http.tsx
View File

@ -92,7 +92,10 @@ const apiWhiteListBase = [
'/api/user/notification/init',
];
const apiWhiteList = apiWhiteListBase.map(path => `${config.baseUrl}${path.replace(/^\//, '')}`);
const apiWhiteList = config.baseUrl
? apiWhiteListBase.map(path => `${config.baseUrl}${path.replace(/^\//, '')}`)
: apiWhiteListBase;
_request.interceptors.request.use((_config) => {
const token = localStorage.getItem(config.authKey);