fix bug

backend/api/internal/middleware/cors.go

@@ -2,26 +2,32 @@
 package middleware
 
 import (
-	"net/http"
+	"time"
 
+	"github.com/gin-contrib/cors"
 	"github.com/gin-gonic/gin"
 )
 
-const (
-	allowedHeaders = "Origin, Content-Length, Content-Type, Workspace, Request-Id, Authorization, Token"
-	allowedMethods = "GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS"
-)
-
 // Cors 允许平台前端跨域调用 API，包括状态更新使用的 PATCH 方法。
 func Cors() gin.HandlerFunc {
-	return func(ctx *gin.Context) {
-		ctx.Header("Access-Control-Allow-Origin", "*")
-		ctx.Header("Access-Control-Allow-Headers", allowedHeaders)
-		ctx.Header("Access-Control-Allow-Methods", allowedMethods)
-		if ctx.Request.Method == http.MethodOptions {
-			ctx.AbortWithStatus(http.StatusNoContent)
-			return
-		}
-		ctx.Next()
-	}
+	return cors.New(cors.Config{
+		AllowOriginFunc: func(origin string) bool {
+			return true // 允许所有域名
+		},
+		AllowMethods: []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
+		AllowHeaders: []string{
+			"Origin",
+			"Content-Type",
+			"Authorization",
+			"X-Requested-With",
+			"X-App-Id",
+			"X-Doip-App-Id",
+			"X-Lowcode-Mode",
+			"X-Lowcode-Org",
+			"Token",
+		},
+		ExposeHeaders:    []string{"Content-Length"},
+		AllowCredentials: true, // 支持 credentials
+		MaxAge:           12 * time.Hour,
+	})
 }