From eb64ce3d8c47c60f4eed9b3e00972b9117e0b16e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=94=B2=E8=BE=B0=E7=94=9F=E4=BA=A7?= <jiachenlong@local>
Date: Wed, 8 Apr 2026 13:35:18 +0800
Subject: [PATCH] =?UTF-8?q?v1.2.61=20-=20=E5=AE=89=E5=85=A8=E4=BF=AE?=
 =?UTF-8?q?=E5=A4=8D=EF=BC=9ACORS=E9=99=90=E5=88=B6+SECRET=5FKEY=E5=BC=BA?=
 =?UTF-8?q?=E5=88=B6=E7=8E=AF=E5=A2=83=E5=8F=98=E9=87=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/app/core/auth.py | 4 +++-
 backend/app/main.py      | 5 +++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/backend/app/core/auth.py b/backend/app/core/auth.py
index 602723a..2fe7a71 100644
--- a/backend/app/core/auth.py
+++ b/backend/app/core/auth.py
@@ -11,7 +11,9 @@ from app.core.database import SessionLocal
 from app.models.models import User
 
 # 配置
-SECRET_KEY = os.getenv("SECRET_KEY", "your-secret-key-change-in-production")
+SECRET_KEY = os.getenv("SECRET_KEY")
+if not SECRET_KEY:
+    raise ValueError("SECRET_KEY environment variable is not set. Please configure it in production!")
 ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_MINUTES = int(os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "10080"))  # 7天
 
diff --git a/backend/app/main.py b/backend/app/main.py
index 2ec184f..73ade76 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -52,10 +52,11 @@ app = FastAPI(
 # 设置全局错误处理器
 setup_error_handlers(app)
 
-# CORS 配置
+# CORS 配置 - 生产环境限制域名
+ALLOWED_ORIGINS = os.getenv("ALLOWED_ORIGINS", "http://47.103.29.111,http://120.55.81.21,https://socoolbot.com").split(",")
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],  # 生产环境应该限制域名
+    allow_origins=ALLOWED_ORIGINS,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],