From 28ab4e2527510533cb1e2bc3dedf0338801e4ee0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E8=98=AD?= <81747598+lan-yonghui@users.noreply.github.com>
Date: Fri, 23 May 2025 14:48:12 +0800
Subject: [PATCH] ref: api auth (#8791)

---
 core/init/router/router.go | 2 +-
 core/middleware/session.go | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/core/init/router/router.go b/core/init/router/router.go
index 1c9bc1666..e5ad7ccd4 100644
--- a/core/init/router/router.go
+++ b/core/init/router/router.go
@@ -79,6 +79,7 @@ func Routers() *gin.Engine {
 	Router.Use(middleware.PasswordExpired())
 	Router.Use(middleware.WhiteAllow())
 	Router.Use(middleware.BindDomain())
+	Router.Use(middleware.ApiAuth())
 
 	PrivateGroup := Router.Group("/api/v2/core")
 	PrivateGroup.Use(middleware.SetPasswordPublicKey())
@@ -86,7 +87,6 @@ func Routers() *gin.Engine {
 		router.InitRouter(PrivateGroup)
 	}
 
-	Router.Use(middleware.ApiAuth())
 	Router.Use(Proxy())
 	Router.NoRoute(func(c *gin.Context) {
 		if !security.HandleNotRoute(c) {
diff --git a/core/middleware/session.go b/core/middleware/session.go
index 40550f815..979993f5c 100644
--- a/core/middleware/session.go
+++ b/core/middleware/session.go
@@ -12,7 +12,8 @@ import (
 
 func SessionAuth() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		if strings.HasPrefix(c.Request.URL.Path, "/api/v2/core/auth") {
+		apiReq := c.GetBool("API_AUTH")
+		if strings.HasPrefix(c.Request.URL.Path, "/api/v2/core/auth") || apiReq {
 			c.Next()
 			return
 		}