From 98bf7ed6a97463279d64333ff8eaa90cab3670cd Mon Sep 17 00:00:00 2001
From: yanweidong <david.yan@qq.com>
Date: Fri, 31 Jul 2026 17:36:25 +0800
Subject: [PATCH] fix bug

---
 backend/api/internal/middleware/cors.go | 38 ++++++++++++++-----------
 deploy/heqiapp.conf                     | 10 +++----
 2 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/backend/api/internal/middleware/cors.go b/backend/api/internal/middleware/cors.go
index 9758483..09c44b3 100644
--- a/backend/api/internal/middleware/cors.go
+++ b/backend/api/internal/middleware/cors.go
@@ -2,26 +2,32 @@
 package middleware
 
 import (
-	"net/http"
+	"time"
 
+	"github.com/gin-contrib/cors"
 	"github.com/gin-gonic/gin"
 )
 
-const (
-	allowedHeaders = "Origin, Content-Length, Content-Type, Workspace, Request-Id, Authorization, Token"
-	allowedMethods = "GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS"
-)
-
 // Cors 允许平台前端跨域调用 API，包括状态更新使用的 PATCH 方法。
 func Cors() gin.HandlerFunc {
-	return func(ctx *gin.Context) {
-		ctx.Header("Access-Control-Allow-Origin", "*")
-		ctx.Header("Access-Control-Allow-Headers", allowedHeaders)
-		ctx.Header("Access-Control-Allow-Methods", allowedMethods)
-		if ctx.Request.Method == http.MethodOptions {
-			ctx.AbortWithStatus(http.StatusNoContent)
-			return
-		}
-		ctx.Next()
-	}
+	return cors.New(cors.Config{
+		AllowOriginFunc: func(origin string) bool {
+			return true // 允许所有域名
+		},
+		AllowMethods: []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
+		AllowHeaders: []string{
+			"Origin",
+			"Content-Type",
+			"Authorization",
+			"X-Requested-With",
+			"X-App-Id",
+			"X-Doip-App-Id",
+			"X-Lowcode-Mode",
+			"X-Lowcode-Org",
+			"Token",
+		},
+		ExposeHeaders:    []string{"Content-Length"},
+		AllowCredentials: true, // 支持 credentials
+		MaxAge:           12 * time.Hour,
+	})
 }
diff --git a/deploy/heqiapp.conf b/deploy/heqiapp.conf
index 108721f..314734b 100644
--- a/deploy/heqiapp.conf
+++ b/deploy/heqiapp.conf
@@ -9,7 +9,7 @@ http://rest.heqiapp.com {
 
 }
 
-heqiapp.com {
+http://heqiapp.com {
 	encode gzip
 	root * /data/heqiapp/dist/site
 
@@ -26,7 +26,7 @@ heqiapp.com {
 	}
 }
 
-www.heqiapp.com {
+http://www.heqiapp.com {
 	encode gzip
 	root * /data/heqiapp/dist/site
 
@@ -44,7 +44,7 @@ www.heqiapp.com {
 }
 
 
-p.heqiapp.com {
+http://p.heqiapp.com {
 	encode gzip
 	root * /data/heqiapp/dist/platform
 
@@ -61,7 +61,7 @@ p.heqiapp.com {
 	}
 }
 
-z.heqiapp.com {
+http://z.heqiapp.com {
 	encode gzip
 	root * /data/heqiapp/dist/gas
 
@@ -78,7 +78,7 @@ z.heqiapp.com {
 	}
 }
 
-d.heqiapp.com {
+http://d.heqiapp.com {
 	encode gzip
 	root * /data/heqiapp/dist/delivery