From 2fb9c3ccfd44e18c60363e30d1807d706639a731 Mon Sep 17 00:00:00 2001
From: hezhaohui <hezhaohui0807@163.com>
Date: Tue, 28 Jul 2026 17:30:46 +0800
Subject: [PATCH] fix(auth): remove access_token query parameter from
 AuthMiddleware
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

移除认证中间件中 access_token 查询参数的回退逻辑，防止令牌通过 URL 暴露

- 仅支持 Authorization: Bearer 请求头认证
- 防止令牌被反向代理日志、浏览器历史、监控系统等捕获
- 前端已使用安全的头部认证方式
---
 server/internal/handler/context.go | 2 --
 1 file changed, 2 deletions(-)

diff --git a/server/internal/handler/context.go b/server/internal/handler/context.go
index d138dda..e28e719 100644
--- a/server/internal/handler/context.go
+++ b/server/internal/handler/context.go
@@ -18,8 +18,6 @@ func AuthMiddleware(cfg config.Config) gin.HandlerFunc {
 		tokenValue := ""
 		if strings.HasPrefix(value, "Bearer ") {
 			tokenValue = strings.TrimPrefix(value, "Bearer ")
-		} else {
-			tokenValue = strings.TrimSpace(c.Query("access_token"))
 		}
 		if tokenValue == "" {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing bearer token"})