优化结构

internal/server/middleware/audit.go

@@ -8,7 +8,6 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"strconv"
 	"strings"
 	"time"
 
@@ -75,8 +74,6 @@ func OperationAudit(runtime *config.Store, recorder *service.AuditRecorder) gin.
 		userID := uint(0)
 		if claims := Claims(c); claims != nil {
 			userID = claims.ID
-		} else if value, err := strconv.ParseUint(c.GetHeader("x-user-id"), 10, 64); err == nil {
-			userID = uint(value)
 		}
 		requestID, _ := c.Get("request_id")
 		status := c.Writer.Status()

internal/server/middleware/cors.go

@@ -10,7 +10,7 @@ import (
 )
 
 const (
-	defaultCORSHeaders = "Content-Type,AccessToken,X-CSRF-Token, Authorization, Token,X-Token,X-User-Id"
+	defaultCORSHeaders = "Content-Type,AccessToken,X-CSRF-Token, Authorization, Token,X-Token"
 	defaultCORSMethods = "POST, GET, OPTIONS,DELETE,PUT"
 	defaultCORSExpose  = "Content-Length, Access-Control-Allow-Origin, Access-Control-Allow-Headers, Content-Type, New-Token, New-Expires-At"
 )

internal/server/middleware/cors_identity_test.go

@@ -0,0 +1,12 @@
+package middleware
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestDefaultCORSHeadersDoNotAllowUserIdentityHeader(t *testing.T) {
+	if strings.Contains(strings.ToLower(defaultCORSHeaders), "x-user-id") {
+		t.Fatal("default CORS headers still allow the forgeable x-user-id header")
+	}
+}

internal/server/middleware/error_audit.go

@@ -68,7 +68,7 @@ func failureLogModule(path string) string {
 }
 
 func expectedClientFailure(message string) bool {
-	for _, value := range []string{"参数错误", "请输入用户名和密码", "验证码错误", "用户名不存在或者密码错误", "用户被禁止登录", "账号已锁定", "权限不足", "密码已过期", "未登录", "token", "令牌失效"} {
+	for _, value := range []string{"参数错误", "请输入用户名和密码", "验证码错误", "用户名不存在或者密码错误", "用户被禁止登录", "账号已锁定", "请求太过频繁", "权限不足", "密码已过期", "未登录", "token", "令牌失效"} {
 		if strings.Contains(message, value) {
 			return true
 		}