8cf78dc295
不再依赖 IFRAME_ALLOW_ORIGINS 手动配置 Sub2API 域名， 自动从 SUB2API_BASE_URL 提取 origin 加入 CSP frame-ancestors。 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
36 lines
924 B
TypeScript
36 lines
924 B
TypeScript
import { NextResponse } from 'next/server';
|
||
import type { NextRequest } from 'next/server';
|
||
|
||
export function middleware(request: NextRequest) {
|
||
const response = NextResponse.next();
|
||
|
||
// 自动从 SUB2API_BASE_URL 提取 origin，允许 Sub2API 主站 iframe 嵌入
|
||
const sub2apiUrl = process.env.SUB2API_BASE_URL || '';
|
||
const extraOrigins = process.env.IFRAME_ALLOW_ORIGINS || '';
|
||
|
||
const origins = new Set<string>();
|
||
|
||
if (sub2apiUrl) {
|
||
try {
|
||
origins.add(new URL(sub2apiUrl).origin);
|
||
} catch {
|
||
// ignore invalid URL
|
||
}
|
||
}
|
||
|
||
for (const s of extraOrigins.split(',')) {
|
||
const trimmed = s.trim();
|
||
if (trimmed) origins.add(trimmed);
|
||
}
|
||
|
||
if (origins.size > 0) {
|
||
response.headers.set('Content-Security-Policy', `frame-ancestors 'self' ${[...origins].join(' ')}`);
|
||
}
|
||
|
||
return response;
|
||
}
|
||
|
||
export const config = {
|
||
matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
|
||
};
|