oadmin/sub2api
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: 修复 CSP 策略阻止 Cloudflare Turnstile 加载的问题

Browse Source 
在 script-src 和 frame-src 中添加 challenges.cloudflare.com 域名，
允许 Turnstile 脚本加载和 iframe 渲染。
This commit is contained in:
shaw
2026-01-06 09:15:03 +08:00
parent af753de481
commit aaaa68ea7f
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/internal/config/config.go
View File

@@ -17,7 +17,7 @@ const (
RunModeSimple = "simple" RunModeSimple = "simple"
) )
const DefaultCSPPolicy = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" const DefaultCSPPolicy = "default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:; frame-src https://challenges.cloudflare.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
// 连接池隔离策略常量 // 连接池隔离策略常量
// 用于控制上游 HTTP 连接池的隔离粒度，影响连接复用和资源消耗 // 用于控制上游 HTTP 连接池的隔离粒度，影响连接复用和资源消耗

2
deploy/config.example.yaml
View File

@@ -97,7 +97,7 @@ security:
enabled: true enabled: true
# Default CSP policy (override if you host assets on other domains) # Default CSP policy (override if you host assets on other domains)
# 默认 CSP 策略（如果静态资源托管在其他域名，请自行覆盖） # 默认 CSP 策略（如果静态资源托管在其他域名，请自行覆盖）
policy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" policy: "default-src 'self'; script-src 'self' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:; frame-src https://challenges.cloudflare.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
proxy_probe: proxy_probe:
# Allow skipping TLS verification for proxy probe (debug only) # Allow skipping TLS verification for proxy probe (debug only)
# 允许代理探测时跳过 TLS 证书验证（仅用于调试） # 允许代理探测时跳过 TLS 证书验证（仅用于调试）