From a0d114fbc441e3d77096c5da4fbb1e964c5275d6 Mon Sep 17 00:00:00 2001
From: zhenhui <1276357500@qq.com>
Date: Mon, 30 Mar 2026 12:45:48 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E8=B7=A8=E5=9F=9F=E6=8A=A5?=
 =?UTF-8?q?=E9=94=99?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/common/middleware/AllowCrossDomain.php | 28 +++++++++++++++++-----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/app/common/middleware/AllowCrossDomain.php b/app/common/middleware/AllowCrossDomain.php
index 34a608e..ede3651 100644
--- a/app/common/middleware/AllowCrossDomain.php
+++ b/app/common/middleware/AllowCrossDomain.php
@@ -21,6 +21,25 @@ class AllowCrossDomain implements MiddlewareInterface
         'Access-Control-Allow-Headers'     => '*',
     ];
 
+    /**
+     * 读取预检请求中的 Access-Control-Request-Headers（经 CDN/反代时 Request 可能取不到，补读 $_SERVER）
+     */
+    private static function accessControlRequestHeaders(Request $request): string
+    {
+        $reqHeaders = $request->header('access-control-request-headers', '');
+        if (is_array($reqHeaders)) {
+            $reqHeaders = $reqHeaders[0] ?? '';
+        }
+        if (is_string($reqHeaders) && trim($reqHeaders) !== '') {
+            return trim($reqHeaders);
+        }
+        $fromServer = $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS'] ?? '';
+        if (is_string($fromServer) && trim($fromServer) !== '') {
+            return trim($fromServer);
+        }
+        return '';
+    }
+
     /**
      * 返回 CORS 预检（OPTIONS）响应，供路由直接调用（Webman 未匹配路由时不走中间件）
      */
@@ -30,7 +49,7 @@ class AllowCrossDomain implements MiddlewareInterface
             'Access-Control-Allow-Credentials' => 'true',
             'Access-Control-Max-Age'            => '1800',
             'Access-Control-Allow-Methods'      => 'GET, POST, PUT, DELETE, PATCH, OPTIONS',
-            'Access-Control-Allow-Headers'      => 'Content-Type, Authorization, batoken, ba-user-token, think-lang, lang',
+            'Access-Control-Allow-Headers'      => 'Content-Type, Authorization, batoken, ba-user-token, think-lang, lang, server',
         ];
         $origin = $request->header('origin');
         if (is_array($origin)) {
@@ -49,11 +68,8 @@ class AllowCrossDomain implements MiddlewareInterface
             if ($allowed) {
                 $header['Access-Control-Allow-Origin'] = $origin;
                 // 回显浏览器在预检中声明的请求头，避免白名单遗漏导致 CORS 失败
-                $reqHeaders = $request->header('access-control-request-headers', '');
-                if (is_array($reqHeaders)) {
-                    $reqHeaders = $reqHeaders[0] ?? '';
-                }
-                if (is_string($reqHeaders) && trim($reqHeaders) !== '') {
+                $reqHeaders = self::accessControlRequestHeaders($request);
+                if ($reqHeaders !== '') {
                     $header['Access-Control-Allow-Headers'] = $reqHeaders;
                 }
             }