chore: 去掉未上线前的旧兼容垫片，板块流收口到首页

鉴权只认 cookie、SEO 只走 Next、sort 与推荐对齐；删除 Bearer、Go sitemap、post_type 回填等冗余路径。 Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-16 05:04:47 +08:00
parent 0e61a14ea3
commit 833bcd33a1
33 changed files with 715 additions and 548 deletions
--- a/backend/middleware/security.go
+++ b/backend/middleware/security.go
@@ -32,9 +32,6 @@ func SecurityHeaders() gin.HandlerFunc {
 		// 控制 Referer 信息泄露
 		c.Header("Referrer-Policy", "strict-origin-when-cross-origin")

-		// XSS 防护（旧浏览器兼容，现代浏览器靠 CSP）
-		c.Header("X-XSS-Protection", "1; mode=block")
-
 		// 禁止浏览器缓存敏感页面（可按需覆盖）
 		// c.Header("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")