freedak/GovAI
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: 安全审计修复 - API Key清理 + JWT改为HttpOnly Cookie

Browse Source 
- API Key: run.md/.env/seed_model_providers.sql 中明文Key替换为占位符
- 认证: JWT从localStorage迁移到HttpOnly Cookie，移除后端body返回token
- 前端: api.ts/knowledge/page.tsx/auth.ts 全面改用Cookie认证
- postcss XSS: package.json添加overrides强制升级到8.5.15
- gitignore: 添加server/.env和.env排除规则
- lint: 移除tenant.go中未使用的roleKey常量
- 文档: 新增docs/security-audit-report.md和hardware-requirements.md
This commit is contained in:
selfrelease
2026-06-26 10:44:04 +08:00
parent c011f2eae8
commit a3245b249a
15 changed files with 442 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/.env
+1 -1
View File
@@ -25,7 +25,7 @@ ANTHROPIC_BASE_URL=https://api.anthropic.com
ANTHROPIC_MODEL=claude-sonnet-4-20250514
# 阿里千问 (Qwen)
QWEN_API_KEY=sk-c0c5174892c44ff48d587cd040fbdd40
QWEN_API_KEY=[YOUR_API_KEY]
QWEN_BASE_URL=https://dashscope.aliyuncs.com/compatible-mode/v1
QWEN_MODEL=qwen-plus