From 5e4f32f2abe21ac86935eacce2b2ebfcefdf82ab Mon Sep 17 00:00:00 2001
From: xfy <i@rua.plus>
Date: Mon, 29 Jun 2026 15:59:54 +0800
Subject: [PATCH] docs(main): fix misleading APP_BASE_URL comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

warn_if_app_base_url_unset() is unconditional—localhost dev also
emits a WARN (per csrf.rs doc). The main.rs side note claimed
localhost stays silent, contradicting the implementation.
---
 src/main.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main.rs b/src/main.rs
index 59c32a3..4f4a174 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -241,7 +241,7 @@ fn main() {
         }
 
         // 提醒部署者显式设置 APP_BASE_URL：未设置时 CSRF 会回退到 Host 头，
-        // 反向代理后存在绕过风险（本地 localhost 开发会静默，不打日志）。
+        // 反向代理后存在绕过风险。本地开发未设置时也会打一条 WARN（代价可接受）。
         api::csrf::warn_if_app_base_url_unset();
 
         // 启动前执行数据库迁移。阻塞：完成前不监听端口。