From ce0731c2f277c8246a47d9f66123dd9d56e9c1e8 Mon Sep 17 00:00:00 2001
From: ydy0615 <allenyuan410@gmail.com>
Date: Thu, 19 Feb 2026 20:26:56 +0800
Subject: [PATCH] feat(api): allow X-API-Key and X-Client-IP headers in CORS
 configuration

---
 backend/main.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/main.py b/backend/main.py
index 5e9b7a7..6b630af 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -25,7 +25,7 @@ app.add_middleware(
     allow_origins=["*"],
     allow_credentials=True,
     allow_methods=["*"],
-    allow_headers=["*"],
+    allow_headers=["*", "X-API-Key", "X-Client-IP"],
 )
 
 API_KEY = "your-secret-key-here"  # 建议从环境变量读取