diff --git a/3DTank/tools/serve.js b/3DTank/tools/serve.js
index 9401fe7..25d2519 100644
--- a/3DTank/tools/serve.js
+++ b/3DTank/tools/serve.js
@@ -46,8 +46,8 @@ const UPSTREAM_HEADERS = {
   'user-agent':
     'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0',
   'accept-language': 'zh-CN,zh;q=0.9,en-GB;q=0.8,en;q=0.7,en-US;q=0.6',
-  origin: 'https://3dtank.com',
-  referer: 'https://3dtank.com/',
+  origin: 'https://3dtank.com/play/',
+  referer: 'https://3dtank.com/play/',
 };
 
 const MIME = {
diff --git a/3DTank/tools/wss_server.js b/3DTank/tools/wss_server.js
index 56a3282..1d46c78 100644
--- a/3DTank/tools/wss_server.js
+++ b/3DTank/tools/wss_server.js
@@ -94,8 +94,8 @@ const Ws = RequireWs();
 const UPSTREAM_HEADERS = {
   'user-agent':
     'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0',
-  origin: 'https://3dtank.com',
-  referer: 'https://3dtank.com/',
+  origin: 'https://3dtank.com/play/',
+  referer: 'https://3dtank.com/play/',
 };
 
 // 命令名（入口层已从源码确证；ID 可跨方向复用，故按方向区分）
@@ -530,8 +530,10 @@ WsServer.on('connection', (Client, Req) => {
     UpHeaders[L] = Req.headers[K];
   }
   if (!UpHeaders['user-agent']) UpHeaders['user-agent'] = UPSTREAM_HEADERS['user-agent'];
-  if (!UpHeaders['origin']) UpHeaders['origin'] = UPSTREAM_HEADERS.origin;
-  if (!UpHeaders['referer']) UpHeaders['referer'] = UPSTREAM_HEADERS.referer;
+  // Origin/Referer **强制用真实站点的值**：前端（浏览器）带的是本机地址 http://localhost:8080，
+  // 真实服务器会据此校验来源，必须覆盖，不能透传。
+  UpHeaders['origin'] = UPSTREAM_HEADERS.origin;
+  UpHeaders['referer'] = UPSTREAM_HEADERS.referer;
   const ClientProto = Req.headers['sec-websocket-protocol'];
   const UpProtocols = ClientProto
     ? String(ClientProto).split(',').map(function (S) { return S.trim(); }).filter(Boolean)