修复开发代理登录会话校验

backend/listen/http_server/https_server.go

@@ -118,7 +118,7 @@ func contextIterceptor(h controllers.HandlerFunc) http.HandlerFunc {
 				return
 			}
 
-			if stateChangingMethod(r.Method) && hasSessionCookie(r) && (!sameOriginRequest(r) || !csrf.Valid(r)) {
+			if stateChangingMethod(r.Method) && !csrfExemptPath(r.URL.Path) && hasSessionCookie(r) && (!sameOriginRequest(r) || !csrf.Valid(r)) {
 				response.NewErrorResponse(response.ParamsError, "请求来源校验失败", "").FPrint(w)
 				return
 			}
@@ -262,6 +262,15 @@ func stateChangingMethod(method string) bool {
 	return method == http.MethodPost || method == http.MethodPut || method == http.MethodPatch || method == http.MethodDelete
 }
 
+func csrfExemptPath(path string) bool {
+	switch normalizedAPIPath(path) {
+	case "/api/user/info":
+		return true
+	default:
+		return false
+	}
+}
+
 func hasSessionCookie(r *http.Request) bool {
 	if session.Instance == nil {
 		return false

backend/listen/http_server/https_server_test.go

@@ -30,6 +30,15 @@ func TestRouterRejectsGetForPostOnlyReadStateEndpoints(t *testing.T) {
 	}
 }
 
+func TestCSRFExemptsReadOnlyUserInfoEndpoint(t *testing.T) {
+	if !csrfExemptPath("/api/v1/user/info") {
+		t.Fatal("user info endpoint must be exempt from CSRF token validation")
+	}
+	if csrfExemptPath("/api/v1/user/edit") {
+		t.Fatal("user edit endpoint must keep CSRF token validation")
+	}
+}
+
 func configureProductionOriginTest(t *testing.T) {
 	t.Helper()
 	oldConfig := config.Instance

frontend/vite.config.js

@@ -12,6 +12,19 @@ export default defineConfig(({ mode }) => {
   const backendUrl = (env.VITE_DEV_BACKEND_URL || 'https://127.0.0.1:443').replace(/\/$/, '')
   const backendOrigin = (env.VITE_DEV_BACKEND_ORIGIN || 'https://xuans.com').replace(/\/$/, '')
 
+  const rewriteDevelopmentCookies = (proxyResponse) => {
+    const setCookies = proxyResponse.headers['set-cookie']
+    if (!Array.isArray(setCookies)) {
+      return
+    }
+
+    proxyResponse.headers['set-cookie'] = setCookies.map((cookie) => (
+      cookie
+        .replace(/;\s*Secure/gi, '')
+        .replace(/;\s*Domain=[^;]*/gi, '')
+    ))
+  }
+
   return {
     plugins: [
       vue(),
@@ -42,6 +55,7 @@ export default defineConfig(({ mode }) => {
               proxyRequest.setHeader('x-forwarded-proto', originURL.protocol.replace(':', ''))
               proxyRequest.removeHeader('referer')
             })
+            proxy.on('proxyRes', rewriteDevelopmentCookies)
           }
         },
         "/attachments": {