update

src/api/user.go

@@ -13,7 +13,7 @@ import (
 
 const (
 	CASDOOEN_HOST = "https://auth.3dqueen.cloud"
-	ORIGIN        = "https://www.infish.cn"
+	PROXY_ORIGIN  = "http://localhost:8888"  // 转发请求时使用的固定 Origin
 )
 
 // forwardRequestWithJWT forwards the request to target URL with JWT token and original request data
@@ -41,14 +41,17 @@ func forwardRequestWithJWT(c *gin.Context, targetURL string) (interface{}, error
 		return nil, fmt.Errorf("create request error: %v", err)
 	}
 
-	// Copy original headers
+	// Copy original headers except Origin and Referer
 	for k, v := range c.Request.Header {
-		req.Header[k] = v
+		if k != "Origin" && k != "Referer" {  // 不复制客户端的 Origin 和 Referer
+			req.Header[k] = v
+		}
 	}
 
-	// Set JWT token and Origin
+	// Set fixed Origin and Referer for auth.3dqueen.cloud
+	req.Header.Set("Origin", PROXY_ORIGIN)
+	req.Header.Set("Referer", PROXY_ORIGIN)
 	req.Header.Set("Authorization", jwtToken)
-	req.Header.Set("Origin", ORIGIN)
 
 	// Set content type if it's a POST request
 	if c.Request.Method == "POST" {