fix security and import validation

server/app.js

@@ -17,7 +17,14 @@ const app = express();
 // 请求日志中间件
 app.use(logger.requestLogger);
 
-app.use(cors());
+app.use(cors({
+  origin(origin, callback) {
+    if (!origin || config.corsOrigins.includes(origin)) {
+      return callback(null, true);
+    }
+    return callback(null, false);
+  }
+}));
 app.use(express.json());
 app.use(compression());
 app.use(express.static(path.join(__dirname, '..', 'public'), {