From 0f952a36a534e5e4a7f83fc6ee5377a49fe1b43b Mon Sep 17 00:00:00 2001 From: li Date: Thu, 28 May 2026 14:29:43 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20CORS=E5=A4=B4=E5=86=B2=E7=AA=81=E4=BF=AE?= =?UTF-8?q?=E5=A4=8D=20=E2=80=94=20=E5=88=A0=E9=99=A4=E6=96=B9=E6=B3=95?= =?UTF-8?q?=E7=BA=A7=E9=87=8D=E5=A4=8Dheader=EF=BC=8C=E7=BB=9F=E4=B8=80?= =?UTF-8?q?=E7=94=B1=E6=9E=84=E9=80=A0=E5=87=BD=E6=95=B0=E5=A4=84=E7=90=86?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 根因：构造函数设 Access-Control-Allow-Origin: 具体域名 + Credentials: true， 但每个方法又覆盖成 Origin: *，导致 Credentials+通配符冲突，浏览器拒绝请求。 删除全部41处方法级CORS头，只保留构造函数的白名单机制。 --- application/onlinechip/controller/Pcapi.php | 125 -------------------- 1 file changed, 125 deletions(-) diff --git a/application/onlinechip/controller/Pcapi.php b/application/onlinechip/controller/Pcapi.php index d88c117..925e39d 100755 --- a/application/onlinechip/controller/Pcapi.php +++ b/application/onlinechip/controller/Pcapi.php @@ -50,9 +50,6 @@ class Pcapi extends Controller{ } public function get_version(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); return json(config('app_version')); } public function get_system_info(){ @@ -66,9 +63,6 @@ class Pcapi extends Controller{ } //试玩登录 public function demologin(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -121,9 +115,6 @@ class Pcapi extends Controller{ //保持在线--心跳 public function keepOnline(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -147,9 +138,6 @@ class Pcapi extends Controller{ } //登录optimum public function login(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -255,9 +243,6 @@ class Pcapi extends Controller{ } // 获取用户信息 public function get_user_info(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -324,9 +309,6 @@ class Pcapi extends Controller{ } //用户钱 public function user_money(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -350,9 +332,6 @@ class Pcapi extends Controller{ } //修改密码 public function update_password(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -390,9 +369,6 @@ class Pcapi extends Controller{ } //打赏 public function to_tip(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -436,9 +412,6 @@ class Pcapi extends Controller{ } //好路 public function good_road(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -474,9 +447,6 @@ class Pcapi extends Controller{ } //返回全部桌子 public function all_table(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -1219,9 +1189,6 @@ class Pcapi extends Controller{ } //返回单张桌子 public function singletable(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); // $json_arr = Request::instance()->post(); @@ -1770,9 +1737,6 @@ class Pcapi extends Controller{ } //今日最佳 public function optimum(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -1798,9 +1762,6 @@ class Pcapi extends Controller{ } //游戏记录 public function get_user_bets(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2318,9 +2279,6 @@ class Pcapi extends Controller{ } //上下分记录 public function recharge_record(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2387,9 +2345,6 @@ class Pcapi extends Controller{ } //上下分记录 public function tip_record(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2449,9 +2404,6 @@ class Pcapi extends Controller{ } //开结果后获取会员的下注信息及计算其输赢数目 public function user_bet_baccarat(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2608,9 +2560,6 @@ class Pcapi extends Controller{ } //开结果后获取会员的下注信息及计算其输赢数目 public function user_bet_dt(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2699,9 +2648,6 @@ class Pcapi extends Controller{ //开结果后获取会员的下注信息及计算其输赢数目 public function user_bet_nn(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2734,9 +2680,6 @@ class Pcapi extends Controller{ } //开结果后获取会员的下注信息及计算其输赢数目 public function user_bet_tc(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2769,9 +2712,6 @@ class Pcapi extends Controller{ } //开结果后获取会员的下注信息及计算其输赢数目 public function user_bet_toning(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2803,9 +2743,6 @@ class Pcapi extends Controller{ } //开结果后获取会员的下注信息及计算其输赢数目 public function user_bet_dice(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2836,9 +2773,6 @@ class Pcapi extends Controller{ } } public function user_bet_roulette(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2870,9 +2804,6 @@ class Pcapi extends Controller{ } //快速提现 public function show_withdrawal(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2900,9 +2831,6 @@ class Pcapi extends Controller{ } //确认提现 public function withdrawal(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -2983,9 +2911,6 @@ class Pcapi extends Controller{ } //充值信息 public function show_recharge(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -3022,9 +2947,6 @@ class Pcapi extends Controller{ } //确认充值 public function recharge(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -3081,9 +3003,6 @@ class Pcapi extends Controller{ } //游戏记录 public function get_rob_bet(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -3299,9 +3218,6 @@ class Pcapi extends Controller{ //电话呼入 public function online_call(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); $phone = Request::instance()->post('phone'); if($phone){ $table_info = Db::name('table')->where('phone',$phone)->find(); @@ -3331,9 +3247,6 @@ class Pcapi extends Controller{ * DateTime: 2019/12/12 12:53 */ public function doRegister(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST'); if($data = Request::instance()->post()){ $data = decrypt_data($data); $username = isset($data['username'])?$data['username']:''; @@ -3687,9 +3600,6 @@ class Pcapi extends Controller{ //登录 public function lineLogin(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -3762,9 +3672,6 @@ class Pcapi extends Controller{ } public function app_entrance(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $entrance = array(); $entrance['HallUrl'] = HallUrl; @@ -3780,9 +3687,6 @@ class Pcapi extends Controller{ } //api用户通过接口获取铺信息 public function api_get_info(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $appId = intval(Request::instance()->post("appId")); $nonceStr = trim(Request::instance()->post("nonceStr")); @@ -3831,9 +3735,6 @@ class Pcapi extends Controller{ // 用户充值记录 public function user_recharge() { - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()) { $json_arr = decrypt_data(Request::instance()->post()); if ($json_arr) { @@ -3869,9 +3770,6 @@ class Pcapi extends Controller{ // 用户提现记录 public function user_withdraw() { - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()) { $json_arr = decrypt_data(Request::instance()->post()); if ($json_arr) { @@ -3907,9 +3805,6 @@ class Pcapi extends Controller{ //申请提现 public function apply_withdraw(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -3983,9 +3878,6 @@ class Pcapi extends Controller{ // 申请银行卡提现（越南AlinPay） public function apply_withdraw_bank(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr){ @@ -4079,9 +3971,6 @@ class Pcapi extends Controller{ // 获取越南银行列表 public function get_bank_list_vn(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); $banks = \pay\AlinPay::getBankCodes(); $list = []; @@ -4099,9 +3988,6 @@ class Pcapi extends Controller{ // 取消提现 public function cancel_withdraw(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr) { @@ -4157,9 +4043,6 @@ class Pcapi extends Controller{ */ public function deposit() { - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr) { @@ -4221,9 +4104,6 @@ class Pcapi extends Controller{ */ public function get_free_seat(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE'); if(Request::instance()->isPost()){ $json_arr = decrypt_data(Request::instance()->post()); if($json_arr) { @@ -4265,11 +4145,6 @@ class Pcapi extends Controller{ * 无需鉴权，游客可访问 */ public function get_lobby_data(){ - header('Access-Control-Allow-Origin: *'); - header("Access-Control-Allow-Headers: token, Origin, X-Requested-With, Content-Type, Accept, Authorization"); - header('Access-Control-Allow-Methods: POST,GET,PUT,DELETE,OPTIONS'); - header('Access-Control-Max-Age: 86400'); - // 处理 OPTIONS 预检请求 if(Request::instance()->isOptions()){ return response('', 200);