♻️ reconstruct the authentication mode

app/core/api/common/middleware/cors_middleware.go

@@ -7,7 +7,7 @@ func CORSMiddleware() func(http.Header) {
 		header.Set("Access-Control-Allow-Origin", "*")
 		header.Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, PATCH")
 		header.Set("Access-Control-Expose-Headers", "Content-Length, Content-Type")
-		header.Set("Access-Control-Allow-Headers", "Content-Type,Authorization,Accept-Language,Origin,X-Content-Security,X-UID")
+		header.Set("Access-Control-Allow-Headers", "Content-Type,Authorization,Accept-Language,Origin,X-Content-Security,X-UID,X-Nonce,X-Expire-At")
 		header.Set("Access-Control-Allow-Credentials", "true")
 	}
 }

app/core/api/common/middleware/unsigned_callback_middleware.go

@@ -0,0 +1,13 @@
+package middleware
+
+import (
+	"github.com/zeromicro/go-zero/rest/httpx"
+	"net/http"
+)
+
+func UnsignedCallbackMiddleware() func(w http.ResponseWriter, r *http.Request, next http.Handler, strict bool, code int) {
+	return func(w http.ResponseWriter, r *http.Request, next http.Handler, strict bool, code int) {
+		httpx.WriteJsonCtx(r.Context(), w, http.StatusForbidden, "forbidden")
+		return
+	}
+}