跨域

cmd/api/main.go

@@ -13,6 +13,7 @@ import (
 	"github.com/bytedance/sonic"
 	"github.com/gofiber/fiber/v2"
 	"github.com/gofiber/fiber/v2/middleware/compress"
+	"github.com/gofiber/fiber/v2/middleware/cors"
 	"github.com/gofiber/fiber/v2/middleware/requestid"
 	"github.com/google/uuid"
 	"github.com/redis/go-redis/v9"
@@ -288,6 +289,23 @@ func initMiddleware(app *fiber.App, cfg *config.Config, appLogger *zap.Logger) {
 
 	// 4. Logger - 记录所有请求（在 Compress 之后注册，读到的是未压缩的原始响应体）
 	app.Use(logger.Middleware())
+
+	// 5. CORS - 必须在业务路由和认证中间件之前注册，确保预检请求不被认证拦截
+	if cfg.Middleware.CORS.Enabled {
+		app.Use(cors.New(cors.Config{
+			AllowOrigins:     cfg.Middleware.CORS.AllowOrigins,
+			AllowMethods:     cfg.Middleware.CORS.AllowMethods,
+			AllowHeaders:     cfg.Middleware.CORS.AllowHeaders,
+			ExposeHeaders:    cfg.Middleware.CORS.ExposeHeaders,
+			AllowCredentials: cfg.Middleware.CORS.AllowCredentials,
+			MaxAge:           cfg.Middleware.CORS.MaxAge,
+		}))
+		appLogger.Info("CORS 中间件已启用",
+			zap.String("allow_origins", cfg.Middleware.CORS.AllowOrigins),
+			zap.String("allow_methods", cfg.Middleware.CORS.AllowMethods),
+			zap.Bool("allow_credentials", cfg.Middleware.CORS.AllowCredentials),
+		)
+	}
 }
 
 // initRoutes 注册路由