From 77d8562916aa46080dcb99b7b753b1eac5ab6924 Mon Sep 17 00:00:00 2001 From: Victor_Jay Date: Tue, 2 Jun 2026 18:33:59 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E6=B7=BB=E5=8A=A0=20HSTS=20=E5=93=8D?= =?UTF-8?q?=E5=BA=94=E5=A4=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - SecurityHeaders 中间件增加 Strict-Transport-Security 头 - 仅在 release 模式下启用，避免开发环境 localhost 证书问题 --- internal/middleware/security.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/internal/middleware/security.go b/internal/middleware/security.go index cab764d..59a42bf 100644 --- a/internal/middleware/security.go +++ b/internal/middleware/security.go @@ -4,6 +4,8 @@ import ( "crypto/rand" "encoding/base64" + "metazone.cc/metalab/internal/config" + "github.com/gin-gonic/gin" ) @@ -44,6 +46,11 @@ func SecurityHeaders() gin.HandlerFunc { // 引用策略 c.Header("Referrer-Policy", "strict-origin-when-cross-origin") + // HSTS：仅在 release 模式启用，避免开发环境 localhost 证书问题 + if config.App != nil && config.App.Server.Mode == "release" { + c.Header("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") + } + c.Next() } }