Update app.py

app.py

@@ -2,22 +2,152 @@ from fastapi import FastAPI, Request, Response
 from fastapi.responses import StreamingResponse
 import httpx
 import os
+import random
 
 app = FastAPI()
 
 TARGET_URL = "https://generativelanguage.googleapis.com"
 TIMEOUT = 120.0
 
-# 可选：设置访问密码
 ACCESS_PASSWORD = os.getenv("ACCESS_PASSWORD", "")
 
+# ============== 匿名化配置 ==============
+
+# 需要移除的泄露源 IP 的请求头
+HEADERS_TO_REMOVE = {
+    # IP 相关
+    "x-forwarded-for",
+    "x-real-ip",
+    "x-originating-ip",
+    "x-remote-ip",
+    "x-remote-addr",
+    "x-client-ip",
+    "x-host",
+    "x-forwarded-host",
+    "x-forwarded-proto",
+    "x-forwarded-port",
+    "x-forwarded-server",
+    "forwarded",
+    "via",
+    "true-client-ip",
+    "cf-connecting-ip",
+    "cf-ipcountry",
+    "cf-ray",
+    "cf-visitor",
+    
+    # HF/云服务商特征
+    "x-request-id",
+    "x-trace-id",
+    "x-amzn-trace-id",
+    "x-cloud-trace-context",
+    "x-appengine-country",
+    "x-appengine-city",
+    "x-appengine-region",
+    "x-vercel-id",
+    "x-vercel-ip-country",
+    "x-vercel-ip-city",
+    "x-railway-request-id",
+    
+    # 浏览器/客户端指纹
+    "x-correlation-id",
+    "x-session-id",
+    "x-device-id",
+    
+    # 其他
+    "host",
+    "content-length",
+    "x-proxy-password",
+    "connection",
+    "keep-alive",
+    "proxy-connection",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+}
+
+# 伪装的 User-Agent 池
+USER_AGENTS = [
+    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0",
+    "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15",
+]
+
+# 伪装的 Accept-Language 池
+ACCEPT_LANGUAGES = [
+    "en-US,en;q=0.9",
+    "en-GB,en;q=0.9",
+    "en-US,en;q=0.9,zh-CN;q=0.8",
+    "en,zh-CN;q=0.9,zh;q=0.8",
+]
+
+
+def anonymize_headers(original_headers: dict) -> dict:
+    """清理并匿名化请求头"""
+    clean_headers = {}
+    
+    for key, value in original_headers.items():
+        key_lower = key.lower()
+        
+        # 跳过需要移除的头
+        if key_lower in HEADERS_TO_REMOVE:
+            continue
+        
+        # 跳过任何包含 IP 特征的自定义头
+        if any(x in key_lower for x in ["ip", "forward", "real", "client", "trace", "ray", "cf-"]):
+            continue
+        
+        clean_headers[key] = value
+    
+    # 强制设置干净的头
+    clean_headers["User-Agent"] = random.choice(USER_AGENTS)
+    clean_headers["Accept-Language"] = random.choice(ACCEPT_LANGUAGES)
+    clean_headers["Accept"] = "application/json, text/plain, */*"
+    clean_headers["Accept-Encoding"] = "gzip, deflate, br"
+    
+    # 确保不暴露是代理请求
+    clean_headers.pop("Forwarded", None)
+    clean_headers.pop("Via", None)
+    
+    return clean_headers
+
+
+def anonymize_response_headers(headers: dict) -> dict:
+    """清理响应头，移除可能暴露代理信息的字段"""
+    skip_headers = {
+        "content-encoding", 
+        "transfer-encoding", 
+        "content-length",
+        "alt-svc",           # 可能暴露服务信息
+        "server",            # 服务器信息
+        "x-served-by",
+        "x-cache",
+        "x-cache-hits",
+        "x-timer",
+    }
+    
+    clean = {}
+    for key, value in headers.items():
+        if key.lower() not in skip_headers:
+            clean[key] = value
+    
+    return clean
+
+
 @app.api_route("/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
 async def proxy(request: Request, path: str):
-    # 简单的密码验证（可选）
+    # 密码验证
     if ACCESS_PASSWORD:
         auth_header = request.headers.get("X-Proxy-Password", "")
         if auth_header != ACCESS_PASSWORD:
-            return Response(content='{"error": "Unauthorized"}', status_code=401, media_type="application/json")
+            return Response(
+                content='{"error": "Unauthorized"}', 
+                status_code=401, 
+                media_type="application/json"
+            )
 
     # 构建目标 URL
     target_url = f"{TARGET_URL}/{path}"
@@ -27,18 +157,19 @@ async def proxy(request: Request, path: str):
     # 获取请求体
     body = await request.body()
 
-    # 过滤 headers
-    headers = {}
-    for key, value in request.headers.items():
-        if key.lower() not in ("host", "x-proxy-password", "content-length"):
-            headers[key] = value
+    # 匿名化请求头
+    headers = anonymize_headers(dict(request.headers))
 
-    async with httpx.AsyncClient(timeout=TIMEOUT) as client:
-        # 检���是否为流式请求
-        is_stream = "stream" in path.lower() or b'"stream":true' in body.lower() if body else False
+    # 使用干净的 httpx 客户端（不传递任何默认头）
+    async with httpx.AsyncClient(
+        timeout=TIMEOUT,
+        follow_redirects=True,
+        http2=True,  # 使用 HTTP/2 更难被识别
+    ) as client:
+        
+        is_stream = "stream" in path.lower() or (body and b'"stream":true' in body.lower())
 
         if is_stream:
-            # 流式响应
             req = client.build_request(
                 method=request.method,
                 url=target_url,
@@ -55,11 +186,10 @@ async def proxy(request: Request, path: str):
             return StreamingResponse(
                 generate(),
                 status_code=response.status_code,
-                headers=dict(response.headers),
+                headers=anonymize_response_headers(dict(response.headers)),
                 media_type=response.headers.get("content-type")
             )
         else:
-            # 普通响应
             response = await client.request(
                 method=request.method,
                 url=target_url,
@@ -67,23 +197,21 @@ async def proxy(request: Request, path: str):
                 content=body
             )
 
-            # 过滤响应 headers
-            resp_headers = {}
-            for key, value in response.headers.items():
-                if key.lower() not in ("content-encoding", "transfer-encoding", "content-length"):
-                    resp_headers[key] = value
-
             return Response(
                 content=response.content,
                 status_code=response.status_code,
-                headers=resp_headers,
+                headers=anonymize_response_headers(dict(response.headers)),
                 media_type=response.headers.get("content-type")
             )
 
+
 @app.get("/")
 async def root():
-    return {
-        "status": "running",
-        "message": "Gemini API Proxy",
-        "usage": "Replace https://generativelanguage.googleapis.com with this proxy URL"
-    }
+    # 不暴露任何有用信息
+    return {"status": "ok"}
+
+
+# 健康检查也保持匿名
+@app.get("/health")
+async def health():
+    return {"status": "ok"}