处理跨域、抽奖增加白名单的问题

authentication/src/main/java/com/jzg/config/SecurityConfig.java

@@ -95,7 +95,7 @@ public class SecurityConfig {
                                 "/auth/login","/auth/captchaById","/auth/register","/sendSmsCode","/appLogin","/smsCodeLogin","/auth/publicKeyExchange","/appAuth/smsCodeLogin","/send/sendSmsCode",
                                 "/appAuth/appLogin","/auth/sendSmsCode","/auth/forgotPassword","/appAuth/partnerAppLogin",
                                 "/supplementOrder/getOrderDetail","/dict/get", "/getAllButtons","/order/qrCode/**","/appUser/userInfoGet",
-                                "/appUser/distributorInvite","/appUser/invitationRegister").permitAll()
+                                "/appUser/distributorInvite","/appUser/invitationRegister","/system/sysListAccountLinking","/signIn/updateSignCompleteRuleIn").permitAll()
                         .anyRequest().authenticated()  // 其他接口需认证
                 )
 //                .formLogin((form) -> form

gateway/src/main/java/com/jzg/filter/AuthGlobalFilter.java

@@ -10,6 +10,7 @@ import org.springframework.core.Ordered;
 import org.springframework.core.annotation.Order;
 import org.springframework.core.io.buffer.DataBuffer;
 import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpMethod;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.stereotype.Component;
@@ -94,6 +95,11 @@ public class AuthGlobalFilter implements GlobalFilter {
     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
         String path = exchange.getRequest().getURI().getPath();
 
+        // 跳过 CORS 预检请求
+        if (HttpMethod.OPTIONS.matches(exchange.getRequest().getMethod().name())) {
+            return chain.filter(exchange);
+        }
+
         // 1. 白名单路径直接放行
         if (isWhitelisted(path)) {
             return chain.filter(exchange);

gateway/src/main/java/com/jzg/filter/DecryptFilter.java

@@ -15,6 +15,7 @@ import org.springframework.cloud.gateway.filter.GlobalFilter;
 import org.springframework.core.io.buffer.DataBuffer;
 import org.springframework.core.io.buffer.DataBufferFactory;
 import org.springframework.core.io.buffer.DataBufferUtils;
+import org.springframework.http.HttpMethod;
 import org.springframework.http.server.reactive.ServerHttpRequest;
 import org.springframework.http.server.reactive.ServerHttpRequestDecorator;
 import org.springframework.stereotype.Component;
@@ -25,6 +26,7 @@ import reactor.core.publisher.Mono;
 import java.nio.ByteBuffer;
 import java.nio.charset.StandardCharsets;
 import java.security.PrivateKey;
+import java.util.List;
 
 
 @Component
@@ -41,8 +43,17 @@ public class DecryptFilter implements GlobalFilter {
     @Override
     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
         ServerHttpRequest request = exchange.getRequest();
+        // CORS 预检请求直接放行，避免 NPE
+        if (HttpMethod.OPTIONS.matches(request.getMethod().name())) {
+            return chain.filter(exchange);
+        }
         boolean contains = request.getURI().getPath().contains("/publicKeyExchange");
         if(isEncrypted && !contains) {
+            // 空指针保护
+            List<String> authHeaders = exchange.getRequest().getHeaders().get("authorization");
+            if (authHeaders == null || authHeaders.isEmpty()) {
+                return chain.filter(exchange);
+            }
             String token = exchange.getRequest().getHeaders().get("authorization").get(0);
             String userName = baseController.getUserName(token);
             // 使用 ServerHttpRequestDecorator 包装请求