CORE ARCHITECTURE
& WAF

CLIENT

Confidential SaaS

ROLE

Backend Security

YEAR

2025

AWARDS / TYPE

Independent Work

PROJECT
OVERVIEW

Implemented strict CSP policies, environmental fingerprint verification, and triple authentication for API interfaces to ensure an impenetrable backend server.

app.py

# _*_coding : utf-8 _*_
from flask import Flask, request, render_template, jsonify
import hashlib, hmac, logging, sys, requests

# 🔒 服务器环境指纹 (脱敏版)
EXPECTED_PUBLIC_IP = "YOUR_SERVER_PUBLIC_IP"
EXPECTED_UUID = "YOUR_CLOUDFLARE_WAF_UUID"
BOT_API_KEY = "YOUR_BOT_SECRET_API_KEY"

app = Flask(__name__)

@app.after_request
def add_security_headers(response):
    '''设置严格的安全响应头，防御 XSS、点击劫持和恶意广告注入'''
    response.headers['X-Frame-Options'] = 'SAMEORIGIN'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    csp_policy = "default-src 'self'; script-src 'self' 'unsafe-inline';"
    response.headers['Content-Security-Policy'] = csp_policy
    return response

def verify_request():
    '''机器人专用远程 API 三重验证'''
    auth_header = request.headers.get('Authorization')
    if auth_header != f"Bearer {BOT_API_KEY}":
        return False, "Invalid API Key"

    req_uuid = request.headers.get('x-developer-id')
    if req_uuid != EXPECTED_UUID:
        return False, "Invalid UUID Identity"

    return True, "OK"

def check_server_environment():
    '''启动自检：防止代码被窃取后在非授权服务器运行'''
    try:
        public_ip = requests.get('https://api.ipify.org', timeout=5).text.strip()
        if public_ip != EXPECTED_PUBLIC_IP:
            logger.critical("⛔ 严重安全警告: 代码运行在错误的服务器上！启动终止。")
            sys.exit(1)
    except Exception as e:
        logger.error(f"IP 检查失败: {e}")

check_server_environment()

PROJECTOVERVIEW

PROJECT
OVERVIEW