fix: 공개 API와 토너먼트의 사용자·장수 권한 경계를 강화한다

2026-10-10 01:56:31 +09:00
parent 5771701007
commit 4e668b9fb6
31 changed files with 889 additions and 238 deletions
@@ -38,6 +38,11 @@ GATEWAY_INTERNAL_API_URL=http://127.0.0.1:13000
 ACCOUNT_ICON_RESET_RECONCILE_INTERVAL_MS=30000
 WEB_PUSH_OUTBOX_POLL_MS=1000
 GATEWAY_PUBLIC_URL=http://localhost:13000
+# Browser origins default to GATEWAY_PUBLIC_URL (Game API also accepts GAME_PUBLIC_URL).
+# Add exact HTTP(S) origins for a separate frontend; wildcards/null/path entries are rejected.
+# Requests with a different Origin fail with 403 before mutation. No-Origin clients still need auth.
+# API_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5174
+# GAME_PUBLIC_URL=http://localhost:14000
 # Gateway authentication protection shares atomic 60s counters under this prefix.
 # Defaults: 10 login attempts/account, 600 auth requests/socket peer, 1200 globally;
 # expensive auth work is capped at 4/process. Forwarded headers are not trusted.