fix: only enable cors for relay routers to avoid csrf attack

songquanpeng · Sep 17, 2023 · 25c4c11 · 25c4c11
1 parent 0d50ad4
commit 25c4c11
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 2 deletions.
diff --git a/main.go b/main.go
@@ -7,7 +7,6 @@ import (
 	"github.com/gin-gonic/gin"
 	"one-api/common"
 	"one-api/controller"
-	"one-api/middleware"
 	"one-api/model"
 	"one-api/router"
 	"os"
@@ -88,7 +87,6 @@ func main() {
 	server := gin.Default()
 	// This will cause SSE not to work!!!
 	//server.Use(gzip.Gzip(gzip.DefaultCompression))
-	server.Use(middleware.CORS())
 
 	// Initialize session store
 	store := cookie.NewStore([]byte(common.SessionSecret))

diff --git a/router/relay-router.go b/router/relay-router.go
@@ -8,6 +8,7 @@ import (
 )
 
 func SetRelayRouter(router *gin.Engine) {
+	router.Use(middleware.CORS())
 	// https://platform.openai.com/docs/api-reference/introduction
 	modelsRouter := router.Group("/v1/models")
 	modelsRouter.Use(middleware.TokenAuth())