fix(aiot): 缩小 Edge 白名单通配范围,限定具体模块
从 /api/ai/**/edge/** 改为按模块显式列出: - /api/ai/alert/edge/** 告警上报 - /api/ai/device/edge/** 设备心跳(预留) 避免过宽通配带来的安全隐患。 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -105,7 +105,8 @@ public class WebSecurityConfig {
|
||||
defaultExcludes.add("/api/ai/roi/snap/callback");
|
||||
defaultExcludes.add("/api/ai/roi/snap/image");
|
||||
defaultExcludes.add("/api/ai/camera/get");
|
||||
defaultExcludes.add("/api/ai/**/edge/**");
|
||||
defaultExcludes.add("/api/ai/alert/edge/**");
|
||||
defaultExcludes.add("/api/ai/device/edge/**");
|
||||
|
||||
if (userSetting.getInterfaceAuthentication() && !userSetting.getInterfaceAuthenticationExcludes().isEmpty()) {
|
||||
defaultExcludes.addAll(userSetting.getInterfaceAuthenticationExcludes());
|
||||
|
||||
Reference in New Issue
Block a user