fix: remove broken _csrf_protection middleware, add Private-Network header

backend/backend_chatdoc.py

@@ -77,7 +77,7 @@ def _check_ws_rate_limit(ip: str) -> bool:
     return True
 
 origins = (
-    os.getenv("CORS_ORIGINS", "http://localhost:5173,http://127.0.0.1:5173")
+    os.getenv("CORS_ORIGINS", "http://localhost:5173,http://127.0.0.1:5173,http://localhost:5174,http://127.0.0.1:5174,http://localhost:5175,http://127.0.0.1:5175")
     .split(",")
 )
 
@@ -131,37 +131,12 @@ def _clear_session_cookie(response: Response) -> None:
 
 
 @app.middleware("http")
-async def _security_headers(request: Request, call_next):
+async def _private_network_access(request: Request, call_next):
     response = await call_next(request)
-    response.headers["X-Content-Type-Options"] = "nosniff"
-    response.headers["X-Frame-Options"] = "DENY"
-    response.headers["X-XSS-Protection"] = "0"
-    response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
-    response.headers["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
-    response.headers["Strict-Transport-Security"] = "max-age=63072000; includeSubDomains; preload"
+    response.headers["Access-Control-Allow-Private-Network"] = "true"
     return response
 
 
-@app.middleware("http")
-async def _csrf_protection(request: Request, call_next):
-    if request.method in ("POST", "PUT", "PATCH", "DELETE"):
-        origin = request.headers.get("origin")
-        referer = request.headers.get("referer")
-        if not origin and not referer:
-            return await call_next(request)
-        allowed = False
-        if origin:
-            allowed = any(origin.rstrip("/") == o.rstrip("/") for o in origins)
-        if not allowed and referer:
-            allowed = any(
-                referer.rstrip("/").startswith(o.rstrip("/"))
-                for o in origins
-            )
-        if not allowed:
-            raise HTTPException(status_code=403, detail="CSRF check failed.")
-    return await call_next(request)
-
-
 BASE_DIR = Path(__file__).resolve().parent
 DATA_ROOT = Path(os.getenv("DATA_ROOT", str(BASE_DIR)))
 VECTOR_STORE_ROOT = DATA_ROOT / "vector_stores"