非生产环境的 server 不对检查客户端 ip 白名单

src/Middleware/InternalApi.php

@@ -15,6 +15,18 @@ class InternalApi
         app()->configure('internal_api');
     }
 
+    private function isClientIPPermitted ($ip) {
+        if (!app()->environment('production', 'staging')) {
+            return true;
+        }
+        if (Str::startsWith($ip, [
+            '127.0.0.', '192.168.', '10.0.',
+        ])) {
+            return true;
+        }
+        return false;
+    }
+
     /**
      * Handle an incoming request.
      *
@@ -25,11 +37,8 @@ class InternalApi
     public function handle($request, Closure $next)
     {
         $ip = $request->getClientIp();
-
+        if (!$this->isClientIPPermitted($ip)) {
-        if (!Str::startsWith($ip, [
+            return new JsonResponse("$ip is forbidden", 403);
-            '127.0.0.', '192.168.', '10.0.'
-        ])) {
-            return new JsonResponse('', 404);
         }
 
         $params = $request->all();