diff --git a/.gitignore b/.gitignore
index 832053b..fdf60c0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,5 @@ config.json
 *.un~
 *.un
 
+# temp script
+lx-music-source-example.js
\ No newline at end of file
diff --git a/common/config.py b/common/config.py
index ec3cb7f..4880eb5 100644
--- a/common/config.py
+++ b/common/config.py
@@ -65,6 +65,8 @@ class ConfigReadException(Exception):
         "_proxy-desc": "代理配置，HTTP与HTTPS协议需分开配置",
         "log_file": True,
         "_log_file-desc": "是否开启日志文件",
+        "allow_download_script": True,
+        '_allow_download_script-desc': '是否允许直接从服务端下载脚本，开启后可以直接访问/script下载脚本',
     },
     "security": {
         "rate_limit": {
diff --git a/common/lx_script.py b/common/lx_script.py
new file mode 100644
index 0000000..aebbb84
--- /dev/null
+++ b/common/lx_script.py
@@ -0,0 +1,67 @@
+# ----------------------------------------
+# - mode: python -
+# - author: helloplhm-qwq -
+# - name: lx.py -
+# - project: lx-music-api-server -
+# - license: MIT -
+# ----------------------------------------
+# This file is part of the "lx-music-api-server" project.
+
+from . import Httpx
+from . import config
+from . import scheduler
+from .variable import iscn
+from .log import log
+from aiohttp.web import Response
+
+logger = log('lx_script')
+
+async def get_response(retry = 0):
+    if (retry > 10):
+        raise Exception('请求源脚本内容失败')
+    baseurl = 'https://raw.githubusercontent.com/lxmusics/lx-music-api-server/main/lx-music-source-example.js'
+    try:
+        if (iscn and (retry % 2) == 0):
+            req = await Httpx.AsyncRequest('https://mirror.ghproxy.com/' + baseurl)
+        else:
+            req = await Httpx.AsyncRequest(baseurl)
+    except: 
+        return await get_response(retry + 1)
+    return req
+
+async def get_script():
+    req = await get_response()
+    if (req.status == 200):
+        with open('./lx-music-source-example.js', 'w') as f:
+            f.write(req.text)
+            f.close()
+        logger.info('更新源脚本成功')
+    else:
+        raise Exception('请求源脚本内容失败')
+
+async def generate_script_response(request):
+    if (request.query.get('key') != config.read_config('security.key.value') and config.read_config('security.key.enable')):
+        return 'key验证失败'
+    try:
+        with open('./lx-music-source-example.js', 'r') as f:
+            script = f.read()
+    except:
+        return '本地无源脚本'
+    scriptLines = script.split('\n')
+    newScriptLines = []
+    for line in scriptLines:
+        line = line.strip()
+        if (line.startswith('const API_URL')):
+            newScriptLines.append(f'const API_URL = "{request.scheme}://{request.host}/"')
+        elif (line.startswith('const API_KEY')):
+            newScriptLines.append(f'const API_KEY = "{config.read_config("security.key.value")}"')
+        else:
+            newScriptLines.append(line)
+    
+    return Response(text = '\n'.join(newScriptLines), content_type = 'text/javascript',
+                    headers = {
+                        'Content-Disposition': 'attachment; filename=lx-music-source.js'
+                    })
+
+if (config.read_config('common.allow_download_script')):
+    scheduler.append('update_script', get_script)
diff --git a/main.py b/main.py
index 2ddec04..2b757e1 100644
--- a/main.py
+++ b/main.py
@@ -15,6 +15,7 @@
 from common import Httpx
 from common import variable
 from common import scheduler
+from common import lx_script
 from aiohttp.web import Response
 import ujson as json
 import threading
@@ -63,7 +64,7 @@ async def handle_request(request):
             config.updateRequestTime(request.remote_addr)
             # check host
             if (config.read_config("security.allowed_host.enable")):
-                if request.remote_host.split(":")[0] not in config.read_config("security.allowed_host.list"):
+                if request.host.split(":")[0] not in config.read_config("security.allowed_host.list"):
                     if config.read_config("security.allowed_host.blacklist.enable"):
                         config.ban_ip(request.remote_addr, int(config.read_config("security.allowed_host.blacklist.length")))
                     return handleResult({'code': 6, 'msg': '未找到您所请求的资源', 'data': None}, 404)
@@ -117,6 +118,9 @@ async def handle_404(request):
 app.router.add_get('/{method}/{source}/{songId}/{quality}', handle)
 app.router.add_get('/{method}/{source}/{songId}', handle)
 
+if (config.read_config('common.allow_download_script')):
+    app.router.add_get('/script', lx_script.generate_script_response)
+
 # 404
 app.router.add_route('*', '/{tail:.*}', handle_404)