From 859ca98f1e5f146a9f3281eb74f3d35f565abbed Mon Sep 17 00:00:00 2001
From: LIghtJUNction <lightjunction.me@gmail.com>
Date: Sat, 21 Mar 2026 15:14:08 +0800
Subject: [PATCH] Fix: support configuring allowed CORS origins via
 CORS_ALLOW_ORIGIN env var for cross-origin credential requests

---
 astrbot/dashboard/server.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/astrbot/dashboard/server.py b/astrbot/dashboard/server.py
index 5b4f7dbc1..fd034a24c 100644
--- a/astrbot/dashboard/server.py
+++ b/astrbot/dashboard/server.py
@@ -202,9 +202,17 @@ class AstrBotDashboard:
         self.app.json.sort_keys = False
 
         # 配置 CORS
+        # 支持通过环境变量 CORS_ALLOW_ORIGIN 配置允许的域名,多个域名用逗号分隔
+        # 如果前端使用 withCredentials:true,需要设置具体的域名而非 "*"
+        cors_allow_origin = os.environ.get("CORS_ALLOW_ORIGIN", "*")
+        if cors_allow_origin != "*":
+            cors_allow_origin = [
+                origin.strip() for origin in cors_allow_origin.split(",")
+            ]
         self.app = cors(
             self.app,
-            allow_origin="*",
+            allow_origin=cors_allow_origin,
+            allow_credentials=True,
             allow_headers=[
                 "Authorization",
                 "Content-Type",