diff --git a/internal/httpapi/server.go b/internal/httpapi/server.go
index 846796a..ad15e4f 100644
--- a/internal/httpapi/server.go
+++ b/internal/httpapi/server.go
@@ -21,15 +21,21 @@ import (
 )
 
 type Server struct {
-	Registry        *registry.Registry
-	DeveloperToken  string
-	MaxUploadBytes  int64
-	Users           *users.Store
-	Mailer          notify.Sender
-	SessionDuration time.Duration
-	Logger          *log.Logger
-	resetMu         sync.Mutex
-	resetTokens     map[string]resetToken
+	Registry           *registry.Registry
+	DeveloperToken     string
+	MaxUploadBytes     int64
+	Users              *users.Store
+	Mailer             notify.Sender
+	SessionDuration    time.Duration
+	AllowedOrigins     []string
+	AllowedHosts       []string
+	ForceHTTPS         bool
+	TrustProxy         bool
+	AllowLegacyToken   bool
+	RateLimitPerMinute int
+	Logger             *log.Logger
+	resetMu            sync.Mutex
+	resetTokens        map[string]resetToken
 }
 
 type resetToken struct {
@@ -69,7 +75,7 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /api/v1/updates/stream", s.stream)
 	mux.HandleFunc("GET /api/v1/packages", s.packageList)
 	mux.HandleFunc("GET /api/v1/packages/", s.packageRoute)
-	return cors(logging(mux))
+	return securityHeaders(s.hostGuard(s.rateLimit(s.cors(logging(mux)))))
 }
 
 func (s *Server) health(writer http.ResponseWriter, _ *http.Request) {
@@ -407,7 +413,7 @@ func (s *Server) authenticatedUser(request *http.Request) (users.User, bool) {
 }
 
 func (s *Server) uploadUser(request *http.Request) (users.User, bool) {
-	if s.DeveloperToken != "" {
+	if s.DeveloperToken != "" && (s.AllowLegacyToken || (s.AllowedHosts == nil && s.AllowedOrigins == nil)) {
 		value := request.Header.Get("Authorization")
 		if strings.HasPrefix(value, "Bearer ") && strings.TrimPrefix(value, "Bearer ") == s.DeveloperToken {
 			return users.User{ID: "legacy-token", Email: "", Name: "兼容令牌", Role: users.RoleDeveloper, Active: true}, true