From 8cf532b0154f421c3a77bb12fca6013f658e5259 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B0=8F=E8=9A=82=E8=9A=81=E4=BA=91?=
 <xiaomayicloud@163.com>
Date: Mon, 14 Sep 2026 10:18:47 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .env         | 4 +++-
 .env.example | 6 +++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.env b/.env
index c7f442e..220f49a 100644
--- a/.env
+++ b/.env
@@ -137,7 +137,9 @@ CAPTCHA_NOISE_DOTS=30
 CORS_ALLOWED_ORIGINS=http://localhost:8001
 
 # 可信代理层数 - 0=不信任X-Forwarded-For，>=1 表示在反向代理后
-TRUSTED_PROXY_COUNT=0
+TRUSTED_PROXY_COUNT=1
+# 可信代理IP白名单 - nginx同机部署，信任本机回环地址
+TRUSTED_PROXY_IPS=127.0.0.1
 
 
 # ============================================================
diff --git a/.env.example b/.env.example
index e7d1572..690a503 100644
--- a/.env.example
+++ b/.env.example
@@ -130,9 +130,9 @@ CAPTCHA_NOISE_DOTS=30
 # CORS允许的源 - 逗号分隔，如 http://localhost:8001,https://admin.example.com
 CORS_ALLOWED_ORIGINS=http://localhost:8001
 # 可信代理层数 - 0=不信任X-Forwarded-For；仅部署在Nginx等反代后才设>=1
-TRUSTED_PROXY_COUNT=0
-# 可信代理IP白名单（逗号分隔）
-TRUSTED_PROXY_IPS=
+TRUSTED_PROXY_COUNT=1
+# 可信代理IP白名单（逗号分隔）- nginx同机部署，信任本机回环地址
+TRUSTED_PROXY_IPS=127.0.0.1
 
 # ============================================================
 # 邮件配置