diff --git a/app.py b/app.py
index db27d6e..e9d8354 100644
--- a/app.py
+++ b/app.py
@@ -139,7 +139,46 @@ app.mount("/static", StaticFiles(directory="static"), name="static")
 
 # 不校验鉴权的路径前缀（供网关探测 / 文档 / 静态）
 _AUTH_EXEMPT = ("/health", "/docs", "/openapi.json", "/redoc", "/static",
-               "/api/v1/debug", "/api/v1/redraw")
+               "/api/v1/debug", "/api/v1/redraw",
+               "/api/swapHair", "/hairColor")
+
+
+# ---------------------------------------------------------------------------
+# change_hair 代理路由（解决 CORS 问题）
+# ---------------------------------------------------------------------------
+_CHANGE_HAIR_BASE = "http://127.0.0.1:8801"
+
+
+@app.post("/api/swapHair/v1", tags=["change_hair"])
+async def proxy_swap_hair(request: Request):
+    """代理转发到 change_hair /api/swapHair/v1（换发型）"""
+    try:
+        import httpx
+        body = await request.body()
+        async with httpx.AsyncClient(timeout=300.0) as client:
+            resp = await client.post(f"{_CHANGE_HAIR_BASE}/api/swapHair/v1",
+                                    content=body,
+                                    headers={"Content-Type": "application/json"})
+            return JSONResponse(content=resp.json(), status_code=resp.status_code)
+    except Exception as e:
+        logger.exception("代理 swapHair 失败")
+        return err(1007, f"换发型服务异常：{e}")
+
+
+@app.post("/hairColor/v2", tags=["change_hair"])
+async def proxy_hair_color(request: Request):
+    """代理转发到 change_hair /hairColor/v2（换发色）"""
+    try:
+        import httpx
+        body = await request.body()
+        async with httpx.AsyncClient(timeout=300.0) as client:
+            resp = await client.post(f"{_CHANGE_HAIR_BASE}/hairColor/v2",
+                                    content=body,
+                                    headers={"Content-Type": "application/json"})
+            return JSONResponse(content=resp.json(), status_code=resp.status_code)
+    except Exception as e:
+        logger.exception("代理 hairColor 失败")
+        return err(1007, f"换发色服务异常：{e}")
 
 
 @app.middleware("http")