jiazhizhong/OpenIsle
1
0
Fork 0
mirror of https://github.com/nagisa77/OpenIsle.git synced 2026-04-21 03:17:28 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: registerStompEndpoints 里保留一次注册即可，一般写法是一次 addEndpoint("/api/ws") + .withSockJS()，并统一用 setAllowedOriginPatterns(...) 配置白名单，避免同一路径双注册引起歧义。

Browse Source
This commit is contained in:
tim
2025-08-22 23:35:15 +08:00
parent 1c582fbbf1
commit 3a979277e4
2 changed files with 4 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
backend/src/main/java/com/openisle/config/SecurityConfig.java
View File

@@ -99,8 +99,9 @@ public class SecurityConfig {
@Bean @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf(csrf -> csrf.disable()) http.csrf(csrf -> csrf.disable())
.cors(Customizer.withDefaults()) // 让 Spring 自带 CorsFilter 处理预检 .cors(Customizer.withDefaults())
.sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .headers(h -> h.frameOptions(f -> f.sameOrigin()))
.sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.exceptionHandling(eh -> eh.accessDeniedHandler(customAccessDeniedHandler)) .exceptionHandling(eh -> eh.accessDeniedHandler(customAccessDeniedHandler))
.authorizeHttpRequests(auth -> auth .authorizeHttpRequests(auth -> auth
.requestMatchers(HttpMethod.OPTIONS, "/**").permitAll() .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()

23
backend/src/main/java/com/openisle/config/WebSocketConfig.java
View File

@@ -54,28 +54,7 @@ public class WebSocketConfig implements WebSocketMessageBrokerConfigurer {
"https://www.staging.open-isle.com", "https://www.staging.open-isle.com",
websiteUrl, websiteUrl,
websiteUrl.replace("://www.", "://") websiteUrl.replace("://www.", "://")
); ).withSockJS().setWebSocketEnabled(true).setSessionCookieNeeded(false);
// ② SockJS 注册：要单独再配一次，且只能 exact，不支持 patterns
registry.addEndpoint("/api/ws")
.setAllowedOrigins(
// 本地（端口要写死）
"http://localhost:3000",
"http://localhost:3001",
"http://127.0.0.1:3000",
"http://127.0.0.1:3001",
"http://192.168.7.98",
"http://192.168.7.98:3000",
"http://30.211.97.238",
"http://30.211.97.238:3000",
// 线上
"https://staging.open-isle.com",
"https://www.staging.open-isle.com",
websiteUrl,
websiteUrl.replace("://www.", "://")
) .withSockJS()
.setSessionCookieNeeded(false) // 避免强依赖 JSESSIONID
.setWebSocketEnabled(true);
} }