d58b706799
Some checks failed
Lint / build (20) (push) Has been cancelled
- Remove hardcoded admin password, use env var or auto-generate - Fix trustHost to be conditional (Vercel-only by default) - Add HTTP security headers (CSP, X-Frame-Options, HSTS) - Create middleware.ts to activate existing rate limiting - Implement structured logging system - Rewrite error handling in ai-cad service - Update security documentation
55 lines
1.5 KiB
TypeScript
55 lines
1.5 KiB
TypeScript
import type { NextAuthConfig } from "next-auth";
|
|
|
|
export function buildAuthConfig(authUrl?: string | null): NextAuthConfig {
|
|
const resolvedAuthUrl = authUrl || process.env.AUTH_URL || "";
|
|
const isSecure = resolvedAuthUrl.startsWith("https://");
|
|
// Use host-only cookies to avoid cross-domain login issues in multi-domain deployments.
|
|
const cookieDomain = undefined;
|
|
|
|
// trustHost 仅在明确配置时开启，避免 host header 注入攻击
|
|
// 部署在 Vercel 或受信反向代理后时，设置 AUTH_TRUST_HOST=true
|
|
const trustHost =
|
|
process.env.AUTH_TRUST_HOST === "true" ||
|
|
process.env.VERCEL === "1";
|
|
|
|
return {
|
|
trustHost,
|
|
pages: {
|
|
signIn: "/login",
|
|
newUser: "/",
|
|
},
|
|
cookies: {
|
|
sessionToken: {
|
|
name: isSecure ? "__Secure-authjs.session-token" : "authjs.session-token",
|
|
options: {
|
|
httpOnly: true,
|
|
sameSite: "lax",
|
|
path: "/",
|
|
secure: isSecure,
|
|
domain: cookieDomain,
|
|
},
|
|
},
|
|
callbackUrl: {
|
|
name: isSecure ? "__Secure-authjs.callback-url" : "authjs.callback-url",
|
|
options: {
|
|
sameSite: "lax",
|
|
path: "/",
|
|
secure: isSecure,
|
|
domain: cookieDomain,
|
|
},
|
|
},
|
|
csrfToken: {
|
|
name: isSecure ? "__Host-authjs.csrf-token" : "authjs.csrf-token",
|
|
options: {
|
|
httpOnly: true,
|
|
sameSite: "lax",
|
|
path: "/",
|
|
secure: isSecure,
|
|
},
|
|
},
|
|
},
|
|
providers: [],
|
|
callbacks: {},
|
|
};
|
|
}
|