From dd2c6c4c16614818c1f23882494719e3a6826b53 Mon Sep 17 00:00:00 2001 From: TermiNexus Date: Sun, 11 Oct 2026 22:21:14 +0800 Subject: [PATCH] =?UTF-8?q?change(origin):=20Origin/Referer=20=E6=94=B9?= =?UTF-8?q?=E4=B8=BA=20https://3dtank.com/play/=EF=BC=88=E4=B8=AD=E7=BB=A7?= =?UTF-8?q?=E4=B8=8A=E6=B8=B8=E5=BC=BA=E5=88=B6=E8=A6=86=E7=9B=96=20+=20?= =?UTF-8?q?=E9=95=9C=E5=83=8F=E5=9B=9E=E6=BA=90=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - wss_server.js：上游握手头的 origin/referer 不再透传前端值（前端带的是本机 http://localhost:8080），改为强制覆盖为 https://3dtank.com/play/；其余请求头仍整包透传 - serve.js：代理回源（/resources、/config.xml）的 origin/referer 同步改为 https://3dtank.com/play/ --- 3DTank/tools/serve.js | 4 ++-- 3DTank/tools/wss_server.js | 10 ++++++---- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/3DTank/tools/serve.js b/3DTank/tools/serve.js index 9401fe7..25d2519 100644 --- a/3DTank/tools/serve.js +++ b/3DTank/tools/serve.js @@ -46,8 +46,8 @@ const UPSTREAM_HEADERS = { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0', 'accept-language': 'zh-CN,zh;q=0.9,en-GB;q=0.8,en;q=0.7,en-US;q=0.6', - origin: 'https://3dtank.com', - referer: 'https://3dtank.com/', + origin: 'https://3dtank.com/play/', + referer: 'https://3dtank.com/play/', }; const MIME = { diff --git a/3DTank/tools/wss_server.js b/3DTank/tools/wss_server.js index 56a3282..1d46c78 100644 --- a/3DTank/tools/wss_server.js +++ b/3DTank/tools/wss_server.js @@ -94,8 +94,8 @@ const Ws = RequireWs(); const UPSTREAM_HEADERS = { 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0', - origin: 'https://3dtank.com', - referer: 'https://3dtank.com/', + origin: 'https://3dtank.com/play/', + referer: 'https://3dtank.com/play/', }; // 命令名（入口层已从源码确证；ID 可跨方向复用，故按方向区分） @@ -530,8 +530,10 @@ WsServer.on('connection', (Client, Req) => { UpHeaders[L] = Req.headers[K]; } if (!UpHeaders['user-agent']) UpHeaders['user-agent'] = UPSTREAM_HEADERS['user-agent']; - if (!UpHeaders['origin']) UpHeaders['origin'] = UPSTREAM_HEADERS.origin; - if (!UpHeaders['referer']) UpHeaders['referer'] = UPSTREAM_HEADERS.referer; + // Origin/Referer **强制用真实站点的值**：前端（浏览器）带的是本机地址 http://localhost:8080， + // 真实服务器会据此校验来源，必须覆盖，不能透传。 + UpHeaders['origin'] = UPSTREAM_HEADERS.origin; + UpHeaders['referer'] = UPSTREAM_HEADERS.referer; const ClientProto = Req.headers['sec-websocket-protocol']; const UpProtocols = ClientProto ? String(ClientProto).split(',').map(function (S) { return S.trim(); }).filter(Boolean)