From 2ecdc87e406e922e7ba7343ccdec3327bb36f8a3 Mon Sep 17 00:00:00 2001
From: SnowCat Security Bot <security@localhost>
Date: Fri, 13 Nov 2026 03:33:16 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20webui.json=20=E5=A2=9E?=
 =?UTF-8?q?=E8=A1=A5=20allowOrigins=20=E9=BB=98=E8=AE=A4=E9=85=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 与 WebUiConfigSchema 新增的 allowOrigins 字段对齐（CORS 白名单来源）
- token 保持 'random'（启动时随机生成），配置文件本身不落弱口令
---
 packages/snowcat-webui-backend/webui.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/snowcat-webui-backend/webui.json b/packages/snowcat-webui-backend/webui.json
index 5d74c5e..7a9d981 100644
--- a/packages/snowcat-webui-backend/webui.json
+++ b/packages/snowcat-webui-backend/webui.json
@@ -7,5 +7,6 @@
   "accessControlMode": "none",
   "ipWhitelist": [],
   "ipBlacklist": [],
-  "enableXForwardedFor": false
+  "enableXForwardedFor": false,
+  "allowOrigins": []
 }
\ No newline at end of file