From a9236cdc3b69347b616bc20342e1545807b71a4c Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Mon, 29 Dec 2025 16:28:17 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E6=AD=A3=E5=B8=B8?=
 =?UTF-8?q?=E7=BD=91=E9=A1=B5=E8=AE=BF=E9=97=AE=E8=A2=AB=E8=AF=AF=E5=88=A4?=
 =?UTF-8?q?=E4=B8=BA=E5=8F=AF=E7=96=91=E8=AF=B7=E6=B1=82=E7=9A=84=E9=97=AE?=
 =?UTF-8?q?=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 排除正常的应用路径（/api/admin/, /api/, /chat/, /gallery/, /settings/等）
- 避免正常的网页访问被标记为可疑请求
- 只对真正可疑的路径（如/.env, /wp-admin等）进行标记
---
 lib/security/request-monitor.ts | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/security/request-monitor.ts b/lib/security/request-monitor.ts
index 6224974..1a8ac62 100644
--- a/lib/security/request-monitor.ts
+++ b/lib/security/request-monitor.ts
@@ -42,6 +42,23 @@ export function isSuspiciousRequest(request: Request): {
   const pathname = url.pathname;
   const method = request.method;
   
+  // 排除正常的应用路径（避免误报）
+  const allowedPaths = [
+    "/api/admin/",  // 管理后台API（正常功能）
+    "/api/",        // 所有API路径（正常功能）
+    "/chat/",       // 聊天页面
+    "/gallery/",    // 相册页面
+    "/settings/",   // 设置页面
+    "/login",       // 登录页面
+    "/register",    // 注册页面
+  ];
+  
+  // 如果是正常的应用路径，不标记为可疑
+  const isAllowedPath = allowedPaths.some(allowed => pathname.startsWith(allowed));
+  if (isAllowedPath) {
+    return { suspicious: false };
+  }
+  
   // 检查可疑路径
   for (const pattern of SUSPICIOUS_PATHS) {
     if (pathname.includes(pattern)) {
@@ -120,3 +137,4 @@ export async function validateRequestBody(
 
 
 
+