FilesExpand file tree

main

/

extensions.py

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

42 lines (35 loc) · 1.33 KB

main

/

extensions.py

Copy path

Top

File metadata and controls

• Code
• Blame

42 lines (35 loc) · 1.33 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

import os

import secrets

from flask import Flask

from flask_sqlalchemy import SQLAlchemy

from flask_socketio import SocketIO

from flask_wtf.csrf import CSRFProtect

app = Flask(__name__)

# 配置密钥，优先从环境变量获取

secret_key = os.environ.get('FLASK_SECRET_KEY')

if not secret_key:

secret_key = secrets.token_hex(32)

print("WARNING: Using randomly generated SECRET_KEY. Set FLASK_SECRET_KEY environment variable for production.")

app.config['SECRET_KEY'] = secret_key

app.config['SQLALCHEMY_DATABASE_URI'] = os.environ.get(

'DATABASE_URI',

'sqlite:///chatbox.db'

)

app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False

# Session配置

app.config['SESSION_COOKIE_SECURE'] = os.environ.get('FLASK_ENV') == 'production'

app.config['SESSION_COOKIE_HTTPONLY'] = True

app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'

# CSRF配置

app.config['WTF_CSRF_ENABLED'] = True

app.config['WTF_CSRF_TIME_LIMIT'] = 3600

# CORS配置 - 根据环境变量设置

cors_origins = os.environ.get('FLASK_CORS_ORIGINS', '*')

if cors_origins == '*':

print("WARNING: CORS allows all origins. Set FLASK_CORS_ORIGINS environment variable for production.")

db = SQLAlchemy(app)

csrf = CSRFProtect(app)

csrf.exempt('login')

csrf.exempt('register')

csrf.exempt('health_check')

socketio = SocketIO(app, manage_session=False, cors_allowed_origins=cors_origins)