feat: 准备 Admin 线上 HTTPS 部署 (#81)

2026-08-10 02:46:59 +08:00
parent 78c0c4a73b
commit 8cc8574e8a
6 changed files with 101 additions and 9 deletions
@@ -42,8 +42,11 @@ func CSRFMiddleware() gin.HandlerFunc {
 				return
 			}
 			// HttpOnly 必须为 false —— 双提交方案要让页面把值填进表单。
-			// 本项目只监听本机，Secure 先留 false，将来上 HTTPS 再打开。
-			c.SetCookie(csrfCookieName, token, 12*3600, "/", "", false, false)
+			http.SetCookie(c.Writer, &http.Cookie{
+				Name: csrfCookieName, Value: token, Path: "/", HttpOnly: false,
+				Secure: requestIsHTTPS(c.Request), SameSite: http.SameSiteLaxMode,
+				MaxAge: 12 * 3600,
+			})
 		}
 		// 交给模板渲染成隐藏字段
 		c.Set(csrfFieldName, token)