From 1d0f227267ba707786d1bdb5fe3edd0973b2fa5d Mon Sep 17 00:00:00 2001
From: qinglong <qinglong@@users.noreply.github.com>
Date: Sat, 13 Jun 2026 18:07:47 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20API=20Key=20=E5=88=A0=E9=99=A4/=E5=88=9B?=
 =?UTF-8?q?=E5=BB=BA=E5=8E=BB=E6=8E=89=20CSRF=20=E2=80=94=20panel=5Ftoken?=
 =?UTF-8?q?=20HttpOnly=20=E5=89=8D=E7=AB=AF=E6=97=A0=E6=B3=95=E8=AF=BB?=
 =?UTF-8?q?=E5=8F=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SameSite=Lax cookie 已防跨站 POST/DELETE, 无需额外 CSRF header
前端 JS 无法读取 HttpOnly cookie, 无法设置 X-CSRF-Token

Co-Authored-By: Claude <noreply@anthropic.com>
---
 config/permissions/pending_requests.json | 22 ++++++++++++++++++++++
 config/plugins/commands.yaml             |  2 +-
 config/services/network_routes.yaml      |  2 +-
 services/web_panel/routes/apikeys.py     |  4 ++--
 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/config/permissions/pending_requests.json b/config/permissions/pending_requests.json
index a1a18ca..1ec6494 100644
--- a/config/permissions/pending_requests.json
+++ b/config/permissions/pending_requests.json
@@ -196,5 +196,27 @@
       "framework.command.execute"
     ],
     "timestamp": 26822.157063829
+  },
+  "bf684985": {
+    "plugin_name": "example_plugin",
+    "permissions": [
+      "plugin.example.read",
+      "plugin.example.write",
+      "plugin.example.execute",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 27154.600966307
+  },
+  "30f30786": {
+    "plugin_name": "sentinel",
+    "permissions": [
+      "plugin.sentinel.read",
+      "plugin.sentinel.write",
+      "plugin.network.access",
+      "framework.event.subscribe",
+      "framework.command.execute"
+    ],
+    "timestamp": 27154.605505473
   }
 }
\ No newline at end of file
diff --git a/config/plugins/commands.yaml b/config/plugins/commands.yaml
index b1868ba..87bdced 100644
--- a/config/plugins/commands.yaml
+++ b/config/plugins/commands.yaml
@@ -101,7 +101,7 @@ commands:
     permissions:
     - framework.command.test
     source: internal
-last_updated: 26822.134496381
+last_updated: 27154.562528494
 plugin_commands:
   example_plugin:
     echo: *id001
diff --git a/config/services/network_routes.yaml b/config/services/network_routes.yaml
index 80444c6..72b57a8 100644
--- a/config/services/network_routes.yaml
+++ b/config/services/network_routes.yaml
@@ -1,5 +1,5 @@
 http_port: 4200
-last_updated: 26822.153658933
+last_updated: 27154.60330813
 plugin_routes:
   example_plugin:
   - methods:
diff --git a/services/web_panel/routes/apikeys.py b/services/web_panel/routes/apikeys.py
index 398ac4c..09cff6f 100644
--- a/services/web_panel/routes/apikeys.py
+++ b/services/web_panel/routes/apikeys.py
@@ -171,6 +171,6 @@ def setup_routes(app, prefix=""):
             return web.json_response({"error": str(e)}, status=500)
 
     app.router.add_get(f"{prefix}/api/apikeys", panel_auth(list_keys))
-    app.router.add_post(f"{prefix}/api/apikeys", panel_auth(create_key, csrf_protect=True))
-    app.router.add_delete(f"{prefix}/api/apikeys", panel_auth(delete_key, csrf_protect=True))
+    app.router.add_post(f"{prefix}/api/apikeys", panel_auth(create_key))
+    app.router.add_delete(f"{prefix}/api/apikeys", panel_auth(delete_key))
     logger.info(f"🔑 API Key 管理路由已注册 ({prefix}/api/apikeys)")