Edu/services/api-gateway/internal/middleware/cors.go

package middleware

import (
	"net/http"
	"os"
	"strconv"
	"strings"

	"github.com/gin-gonic/gin"
)

// corsMaxAge 预检缓存时长：12 小时
const corsMaxAge = 12 * 60 * 60

// CORS 返回跨域资源共享中间件。
// 允许来源从环境变量 CORS_ORIGINS 读取（逗号分隔，默认 *）。
// 允许方法：GET POST PUT DELETE OPTIONS PATCH
// 允许头：Authorization Content-Type X-Request-Id X-Trace-Id
// 暴露头：X-Request-Id X-Trace-Id
func CORS() gin.HandlerFunc {
	allowed := parseCORSOrigins(os.Getenv("CORS_ORIGINS"))

	return func(c *gin.Context) {
		origin := c.GetHeader("Origin")
		allowOrigin := ""

		if len(allowed) == 0 {
			// 未配置则默认允许所有来源
			allowOrigin = "*"
		} else if allowed[origin] {
			allowOrigin = origin
		}

		if allowOrigin != "" {
			h := c.Writer.Header()
			h.Set("Access-Control-Allow-Origin", allowOrigin)
			h.Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, PATCH")
			h.Set("Access-Control-Allow-Headers", "Authorization, Content-Type, X-Request-Id, X-Trace-Id")
			h.Set("Access-Control-Expose-Headers", "X-Request-Id, X-Trace-Id")
			h.Set("Access-Control-Max-Age", strconv.Itoa(corsMaxAge))
			// 非通配来源需标注 Vary，便于缓存正确区分
			if allowOrigin != "*" {
				h.Add("Vary", "Origin")
			}
		}

		// 预检请求直接返回 204
		if c.Request.Method == http.MethodOptions {
			c.AbortWithStatus(http.StatusNoContent)
			return
		}
		c.Next()
	}
}

// parseCORSOrigins 解析逗号分隔的来源列表为集合，空字符串返回空 map（表示通配 *）
func parseCORSOrigins(raw string) map[string]bool {
	allowed := map[string]bool{}
	if raw == "" {
		return allowed
	}
	for _, o := range strings.Split(raw, ",") {
		o = strings.TrimSpace(o)
		if o != "" {
			allowed[o] = true
		}
	}
	return allowed
}