---
title: "解决 Node 应用接入企业微信登录不显示二维码的问题"
date: 2022-12-30T15:39:47.000Z
author: Z.SHINCHVEN
tags: [Node.js, FeathersJS, helmet.js, Content-Security-Policy, security, cors, 企业微信]
canonical: https://atlassc.net/2022/12/31/wechat-works-login-qr-not-showing-on-nodejs-webapp
---
我在使用 Ant Design Pro 和 FeathersJS 开发一个支持企业微信二维码登录的应用。这个功能之前很顺利地完成过，而这次总是无法加载出二维码。

经过排查是 FeathersJS 使用的 [helmet](https://www.npmjs.com/package/helmet) 库升级了安全策略，默认禁用了站外资源。

要顺利加载企业微信的二维码，需要调整降低安全策略。

```diff
app.use(helmet({
  contentSecurityPolicy: false,
+  crossOriginEmbedderPolicy: false, // 允许 iframe
+  crossOriginResourcePolicy: false, // 允许 站外资源
}))
```

## References

> ### [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
> The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (Cross-site_scripting).

> ### [Cross-Origin-Embedder-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy)
> The HTTP Cross-Origin-Embedder-Policy (COEP) response header prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).

> ### [Cross-Origin-Resource-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy)
> The HTTP Cross-Origin-Resource-Policy response header conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the given resource.