qinglong 634496d975 security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护 ...

修复:
- Sentinel 路由 require_auth=False → True (严重: 未认证可访问)
- API Key 创建/删除加 csrf_protect=True
- SSRF 防护: 测试连接仅允许 http/https scheme
- 插件网络鉴权: 已加载插件自动放行 (不再要求 plugin.network.access)
- Sentinel 权限列表补充 plugin.network.access

Co-Authored-By: Claude <noreply@anthropic.com>

2026-06-13 15:13:56 +08:00

..

framework

security: P3 — 插件隔离默认开启 + SenSuDB 注册 + 审计日志

2026-06-13 13:56:58 +08:00

permissions

security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护

2026-06-13 15:13:56 +08:00

plugins

security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护

2026-06-13 15:13:56 +08:00

services

security: Sentinel 路由鉴权 + API Key CSRF + SSRF 防护

2026-06-13 15:13:56 +08:00