158 lines
45 KiB
JavaScript
158 lines
45 KiB
JavaScript
import{_ as i,o as a,c as n,a2 as h}from"./chunks/framework.BbmSSMjL.js";const g=JSON.parse('{"title":"11.8 安全加固清单","description":"","frontmatter":{},"headers":[],"relativePath":"zh/deploy/security.md","filePath":"zh/deploy/security.md"}'),l={name:"zh/deploy/security.md"};function p(k,s,t,e,d,r){return a(),n("div",null,[...s[0]||(s[0]=[h(`<h1 id="_11-8-安全加固清单" tabindex="-1">11.8 安全加固清单 <a class="header-anchor" href="#_11-8-安全加固清单" aria-label="Permalink to "11.8 安全加固清单""></a></h1><div class="danger custom-block"><p class="custom-block-title">上线前必检</p><p>以下安全配置在生产环境上线前必须完成，否则存在严重安全风险。</p></div><h2 id="必须执行" tabindex="-1">必须执行 <a class="header-anchor" href="#必须执行" aria-label="Permalink to "必须执行""></a></h2><table tabindex="0"><thead><tr><th>项目</th><th>操作</th><th>检查命令</th></tr></thead><tbody><tr><td>JWT 密钥</td><td><code>.env</code> 中 <code>JWT_SECRET</code> 修改为强随机字符串（≥32 字符，缺失/过短时服务拒绝签发令牌，fail-close）</td><td><code>grep JWT_SECRET .env</code></td></tr><tr><td>调试模式</td><td><code>.env</code> 中 <code>APP_DEBUG=false</code></td><td><code>grep APP_DEBUG .env</code></td></tr><tr><td>运行环境</td><td><code>.env</code> 中 <code>APP_ENV=production</code></td><td><code>grep APP_ENV .env</code></td></tr><tr><td>CORS</td><td><code>.env</code> 中 <code>CORS_ALLOW_ORIGIN</code> 限制为实际域名</td><td><code>grep CORS_ALLOW_ORIGIN .env</code></td></tr><tr><td>数据库密码</td><td>修改默认 root 密码</td><td><code>mysql -u root -p</code></td></tr><tr><td>Redis 密码</td><td>设置 requirepass</td><td><code>redis-cli CONFIG GET requirepass</code></td></tr><tr><td>HTTPS</td><td>启用 SSL 证书</td><td><code>curl -I https://your-domain.com</code></td></tr></tbody></table><h2 id="生成强密钥" tabindex="-1">生成强密钥 <a class="header-anchor" href="#生成强密钥" aria-label="Permalink to "生成强密钥""></a></h2><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 生成 JWT 签名密钥（32 字节 = 64 个十六进制字符）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># random_bytes(32) → 生成 32 字节的密码学安全随机数</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># bin2hex() → 转为十六进制字符串（便于复制粘贴到 .env）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">php</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -r</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">echo bin2hex(random_bytes(32));</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 生成 MySQL 密码（16 字节 = 32 个十六进制字符）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">php</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -r</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">echo bin2hex(random_bytes(16));</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 生成 Redis 密码（16 字节 = 32 个十六进制字符）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">php</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -r</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">echo bin2hex(random_bytes(16));</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span></code></pre></div><h2 id="Nginx-安全配置" tabindex="-1">Nginx 安全配置 <a class="header-anchor" href="#Nginx-安全配置" aria-label="Permalink to "Nginx 安全配置""></a></h2><div class="language-nginx vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">nginx</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># =============================================================================</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># Nginx 安全加固配置（添加到 server 块内）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># =============================================================================</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 禁止访问隐藏文件（.env、.git、.htaccess 等）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">location</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> ~</span><span style="--shiki-dark:#E7EE98;--shiki-light:#AB5E3F;"> /\\. </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">{</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> deny </span><span style="--shiki-dark:#BF9EEE;--shiki-light:#1E754F;">all</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">}</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 禁止上传目录执行 PHP（防止 Webshell 攻击）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">location</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> ~</span><span style="--shiki-dark:#E7EE98;--shiki-light:#AB5E3F;"> /uploads/.*\\.php$ </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">{</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> deny </span><span style="--shiki-dark:#BF9EEE;--shiki-light:#1E754F;">all</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">}</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 安全响应头</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># X-Frame-Options → 禁止被嵌入 iframe（防点击劫持）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># X-Content-Type-Options → 禁止浏览器 MIME 类型嗅探</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># X-XSS-Protection → 启用浏览器 XSS 过滤</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># Referrer-Policy → 控制 Referer 头信息泄露</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">add_header </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">X-Frame-Options </span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">"SAMEORIGIN"</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> always</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">add_header </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">X-Content-Type-Options </span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">"nosniff"</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> always</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">add_header </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">X-XSS-Protection </span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">"1; mode=block"</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> always</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">add_header </span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">Referrer-Policy </span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">"strict-origin-when-cross-origin"</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> always</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 隐藏 Nginx 版本号（防止攻击者针对性利用已知漏洞）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">server_tokens </span><span style="--shiki-dark:#BF9EEE;--shiki-light:#1E754F;">off</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">;</span></span></code></pre></div><h2 id="PHP-安全配置" tabindex="-1">PHP 安全配置 <a class="header-anchor" href="#PHP-安全配置" aria-label="Permalink to "PHP 安全配置""></a></h2><div class="language-ini vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">ini</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; =============================================================================</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; php.ini 生产环境安全配置</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; =============================================================================</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 配置路径：/etc/php/8.3/fpm/php.ini</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 生效命令：sudo systemctl restart php8.3-fpm</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; =============================================================================</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">expose_php</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> Off </span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 隐藏 PHP 版本号（防止针对性攻击）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">display_errors</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> Off </span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 不向浏览器显示错误（防止 SQL/路径泄露）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">log_errors</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> On </span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 记录错误到日志文件（Laravel 日志在 storage/logs/）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">allow_url_fopen</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> Off </span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 禁止 fopen 打开远程 URL（防 SSRF）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">disable_functions</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;"> =</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> exec,passthru,shell_exec,system,proc_open </span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 禁用危险系统函数</span></span></code></pre></div><h2 id="文件权限" tabindex="-1">文件权限 <a class="header-anchor" href="#文件权限" aria-label="Permalink to "文件权限""></a></h2><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 项目目录（owner 可读写执行，group/others 可读和执行）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">chmod</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -R</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 755</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> /www/api/</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> # 目录 755，文件自动 644</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">chown</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -R</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> www-data:www-data</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> /www/api/</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> # owner 设为 Web 服务器用户</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 运行时目录（必须可写 — Laravel 缓存、日志、编译视图）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">chmod</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -R</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 777</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> /www/api/storage/</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> # 777 确保 PHP-FPM 可写入</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">chmod</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -R</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 777</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> /www/api/bootstrap/cache/</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> # 配置/路由缓存写入位置</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 上传目录（必须可写 — 用户上传文件存储位置）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">chmod</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -R</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 755</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> /www/api/public/uploads/</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> # 目录可写</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">chown</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -R</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> www-data:www-data</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> /www/api/public/uploads/</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> # owner 设为 Web 服务器用户</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># .env 文件（仅 owner 可读 — 包含数据库密码、JWT 密钥等敏感信息）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 600 = owner 可读写，group/others 无权限</span></span>
|
||
<span class="line"><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">chmod</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 600</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> /www/api/.env</span></span></code></pre></div><h2 id="数据库安全" tabindex="-1">数据库安全 <a class="header-anchor" href="#数据库安全" aria-label="Permalink to "数据库安全""></a></h2><div class="language-sql vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">sql</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- =============================================================================</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- MySQL 安全加固 SQL</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- =============================================================================</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- 在 MySQL 命令行中执行：mysql -u root -p</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- =============================================================================</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- 修改 root 密码（替换 strong_password_here 为实际强密码）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">ALTER</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> USER</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">root</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">@</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">localhost</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> IDENTIFIED </span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">BY</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">strong_password_here</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">;</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- 创建应用专用数据库用户（生产环境不应用 root 连接应用）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- rxthinkcmf_app → 应用专用用户名</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- app_password → 应用专用密码</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">CREATE</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> USER</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> '</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">rxthinkcmf_app</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">'@</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">localhost</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> IDENTIFIED </span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">BY</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">app_password</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">;</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- 授权应用用户只能访问项目数据库（最小权限原则）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- rxthinkcmf.laravel13.naivevue.* → 该项目数据库的所有表</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">GRANT</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> ALL PRIVILEGES </span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">ON</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> \`</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">rxthinkcmf.laravel13.naivevue</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">\`</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">.</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">*</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> TO</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">rxthinkcmf_app</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">@</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">localhost</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">;</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">FLUSH PRIVILEGES; </span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- 刷新权限使配置生效</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- 禁止远程 root 登录（只允许本地连接）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">-- Host NOT IN (...) → 删除非本地的 root 账户</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">DELETE</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> FROM</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> mysql</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">.</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;">user</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> WHERE</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> User</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">=</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">root</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> AND</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> Host </span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">NOT</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> IN</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;"> (</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">localhost</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">, </span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">127.0.0.1</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">, </span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">::1</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">'</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">);</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">FLUSH PRIVILEGES;</span></span></code></pre></div><h2 id="Redis-安全" tabindex="-1">Redis 安全 <a class="header-anchor" href="#Redis-安全" aria-label="Permalink to "Redis 安全""></a></h2><div class="language-ini vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">ini</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># =============================================================================</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># redis.conf 安全配置</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># =============================================================================</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 配置路径：/etc/redis/redis.conf</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 生效命令：sudo systemctl restart redis</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># =============================================================================</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">requirepass your_strong_redis_password </span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 设置访问密码（必须设置）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">bind 127.0.0.1 </span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 只监听本地（禁止外部直接访问）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">protected-mode yes </span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">; 启用保护模式（无密码时拒绝外部连接）</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 禁用危险命令（防止误操作清空数据或修改配置）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 将命令重命名为空字符串 = 禁用该命令</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">rename-command FLUSHALL </span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">""</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> ; 禁用 FLUSHALL（清空所有数据库）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">rename-command FLUSHDB </span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">""</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> ; 禁用 FLUSHDB（清空当前数据库）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F6F6F4;--shiki-light:#393A34;">rename-command CONFIG </span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">""</span><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"> ; 禁用 CONFIG（防止运行时修改配置）</span></span></code></pre></div><div class="warning custom-block"><p class="custom-block-title">Redis 承载关键状态</p><p>本项目的会话、缓存、队列和 JWT 令牌状态均存储在 Redis 中，Redis 泄露等同于会话泄露。除密码外，还应限制网络访问（安全组 / bind 内网），并避免与其它业务共用实例。</p></div><h2 id="安全检查脚本" tabindex="-1">安全检查脚本 <a class="header-anchor" href="#安全检查脚本" aria-label="Permalink to "安全检查脚本""></a></h2><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes dracula-soft vitesse-light vp-code" tabindex="0"><code><span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;">#!/bin/bash</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># =============================================================================</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># check_security.sh — 生产环境安全检查脚本</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># =============================================================================</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 用途：自动检查 .env 中的安全配置项是否符合生产要求</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 用法：cd /www/api && bash check_security.sh</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># =============================================================================</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;">echo</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">=== 安全检查 ===</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 检查 APP_DEBUG 是否关闭</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># grep "^APP_DEBUG" .env → 从 .env 中取 APP_DEBUG 行（^ 锚定行首，排除注释）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># cut -d= -f2 → 以 = 为分隔符取第 2 部分（值）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># tr -d ' ' → 去除空格</span></span>
|
||
<span class="line"><span style="--shiki-dark:#BF9EEE;--shiki-light:#B07D48;">debug</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;">=</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$(</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">grep</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">^APP_DEBUG</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> .env</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> |</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;"> cut</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -d=</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -f2</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> |</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;"> tr</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -d</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">if</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> [</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#B56959;">$debug</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">true</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> ];</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> then</span></span>
|
||
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;"> echo</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">❌ APP_DEBUG 未关闭（生产环境必须为 false）</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">else</span></span>
|
||
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;"> echo</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">✓ APP_DEBUG 已关闭</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">fi</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 检查 JWT 密钥长度（本项目 .env 为扁平键名 JWT_SECRET）</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># \${#secret} → 获取字符串长度</span></span>
|
||
<span class="line"><span style="--shiki-dark:#BF9EEE;--shiki-light:#B07D48;">secret</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;">=</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$(</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">grep</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">^JWT_SECRET</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> .env</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> |</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;"> cut</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -d=</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -f2</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> |</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;"> tr</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -d</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">if</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> [</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> \${</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">#</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#B07D48;">secret</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">}</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> -lt</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#2F798A;"> 32</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> ];</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> then</span></span>
|
||
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;"> echo</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">❌ JWT 密钥太短（建议 32 字符以上，当前 </span><span style="--shiki-dark:#E7EE98;--shiki-light:#999999;">\${</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">#</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#B56959;">secret</span><span style="--shiki-dark:#E7EE98;--shiki-light:#999999;">}</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> 字符）</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">else</span></span>
|
||
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;"> echo</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">✓ JWT 密钥长度足够（</span><span style="--shiki-dark:#E7EE98;--shiki-light:#999999;">\${</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;">#</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#B56959;">secret</span><span style="--shiki-dark:#E7EE98;--shiki-light:#999999;">}</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> 字符）</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">fi</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># 检查 CORS 是否允许所有来源</span></span>
|
||
<span class="line"><span style="--shiki-dark:#7B7F8B;--shiki-light:#A0ADA0;"># -----------------------------------------------------------------------------</span></span>
|
||
<span class="line"><span style="--shiki-dark:#BF9EEE;--shiki-light:#B07D48;">cors</span><span style="--shiki-dark:#F286C4;--shiki-light:#999999;">=</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">$(</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;">grep</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">^CORS_ALLOW_ORIGIN</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;"> .env</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> |</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;"> cut</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -d=</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -f2</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> |</span><span style="--shiki-dark:#62E884;--shiki-light:#59873A;"> tr</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#A65E2B;"> -d</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> '</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;">)</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">if</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> [</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#BF9EEE;--shiki-light:#B56959;">$cors</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span><span style="--shiki-dark:#F286C4;--shiki-light:#AB5959;"> =</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">*</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span><span style="--shiki-dark:#F6F6F4;--shiki-light:#999999;"> ];</span><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;"> then</span></span>
|
||
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;"> echo</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">⚠ CORS 允许所有来源（生产环境建议限制为实际域名）</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">else</span></span>
|
||
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;"> echo</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">✓ CORS 已限制来源</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span>
|
||
<span class="line"><span style="--shiki-dark:#F286C4;--shiki-light:#1E754F;">fi</span></span>
|
||
<span class="line"></span>
|
||
<span class="line"><span style="--shiki-dark:#97E1F1;--shiki-light:#998418;">echo</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;"> "</span><span style="--shiki-dark:#E7EE98;--shiki-light:#B56959;">=== 检查完成 ===</span><span style="--shiki-dark:#DEE492;--shiki-light:#B5695977;">"</span></span></code></pre></div>`,19)])])}const F=i(l,[["render",p]]);export{g as __pageData,F as default};
|