开源前加固认证与部署契约：加密随机 JWT、改密事务吊销、登录 CSRF，并禁止生产回落 localhost。

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-23 02:07:34 +08:00
parent 6f054a903c
commit 3b550f2124
24 changed files with 372 additions and 355 deletions
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -67,6 +67,7 @@ services:
      BACKEND_URL: http://api:3001
      SITE_URL: ${SITE_URL:-https://localhost}
      NODE_ENV: production
+      DEV_MODE: "false"
      PORT: "3000"
      HOSTNAME: 0.0.0.0
    ports: