优化结构

internal/server/middleware/cors.go

@@ -19,6 +19,10 @@ const (
 // configuration reload takes effect without rebuilding the Gin engine.
 func CORS(runtime *conf.Runtime) gin.HandlerFunc {
 	return func(c *gin.Context) {
+		if runtime == nil {
+			c.Next()
+			return
+		}
 		config := runtime.Admin()
 		if config == nil || config.Cors == nil {
 			c.Next()
@@ -28,12 +32,14 @@ func CORS(runtime *conf.Runtime) gin.HandlerFunc {
 		origin := c.GetHeader("Origin")
 		corsHandled := false
 		if mode == "allow-all" {
-			setCORSHeaders(c, origin, defaultCORSHeaders, defaultCORSMethods, defaultCORSExpose, true)
-			corsHandled = true
+			if origin != "" {
+				setCORSHeaders(c, origin, defaultCORSHeaders, defaultCORSMethods, defaultCORSExpose, true)
+				corsHandled = true
+			}
 		} else if rule := matchingCORSRule(config.Cors.Whitelist, origin); rule != nil {
 			setCORSHeaders(c, rule.AllowOrigin, rule.AllowHeaders, rule.AllowMethods, rule.ExposeHeaders, rule.AllowCredentials)
 			corsHandled = true
-		} else if mode == "strict-whitelist" && !(c.Request.Method == http.MethodGet && c.Request.URL.Path == "/health") {
+		} else if mode == "strict-whitelist" && !(c.Request.Method == http.MethodGet && isHealthPath(c.Request.URL.Path)) {
 			c.AbortWithStatus(http.StatusForbidden)
 			return
 		}
@@ -45,6 +51,11 @@ func CORS(runtime *conf.Runtime) gin.HandlerFunc {
 	}
 }
 
+func isHealthPath(path string) bool {
+	path = strings.TrimSuffix(path, "/")
+	return path == "/health" || strings.HasSuffix(path, "/health")
+}
+
 func matchingCORSRule(rules []*conf.AdminBackend_CORSRule, origin string) *conf.AdminBackend_CORSRule {
 	for _, rule := range rules {
 		if rule != nil && origin == rule.AllowOrigin {
@@ -55,6 +66,7 @@ func matchingCORSRule(rules []*conf.AdminBackend_CORSRule, origin string) *conf.
 }
 
 func setCORSHeaders(c *gin.Context, origin, headers, methods, expose string, credentials bool) {
+	c.Header("Vary", "Origin")
 	c.Header("Access-Control-Allow-Origin", origin)
 	c.Header("Access-Control-Allow-Headers", headers)
 	c.Header("Access-Control-Allow-Methods", methods)