From cecb5f271483f7725a9ff78ab87fbaac8f29a703 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B0=8F=E7=BB=AB?= <486494914@qq.com>
Date: Wed, 2 Sep 2026 17:08:52 +0800
Subject: [PATCH] 1

---
 backend/Dockerfile          |  3 ++-
 backend/app/core/config.py  | 10 ++++++++++
 backend/app/core/session.py |  2 +-
 docker-compose.yml          |  2 ++
 4 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/backend/Dockerfile b/backend/Dockerfile
index 8b59a1c..aa24a42 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -19,4 +19,5 @@ VOLUME /app/data
 EXPOSE 8000
 
 # 启动：先跑迁移，再起服务
-CMD ["sh", "-c", "alembic upgrade head && uvicorn app.main:app --host 0.0.0.0 --port 8000 --workers 2"]
\ No newline at end of file
+# 注意：单 worker —— Session 存在进程内存中，多 worker 会导致登录态随机丢失
+CMD ["sh", "-c", "alembic upgrade head && uvicorn app.main:app --host 0.0.0.0 --port 8000 --workers 1"]
\ No newline at end of file
diff --git a/backend/app/core/config.py b/backend/app/core/config.py
index 102f3b9..0dc09cf 100644
--- a/backend/app/core/config.py
+++ b/backend/app/core/config.py
@@ -20,6 +20,9 @@ class Settings(BaseSettings):
     # --- 基础 ---
     environment: str = "local"  # local / production
     secret_key: str = Field(min_length=16)
+    # Cookie Secure 标记：默认跟随 environment（production→Secure）。
+    # 站点还是 HTTP 时必须显式设为 false，否则浏览器丢弃 Cookie 导致登录后立即被踢回。
+    cookie_secure: bool | None = None
 
     # --- 数据库 ---
     database_url: str = "mysql+pymysql://admin:Lzcc6-01@47.109.98.44:33306/amb_rag?charset=utf8mb4"
@@ -42,6 +45,13 @@ class Settings(BaseSettings):
     def is_production(self) -> bool:
         return self.environment == "production"
 
+    @property
+    def use_secure_cookie(self) -> bool:
+        """HTTPS 站点才应启用 Secure Cookie；未显式配置时跟随 environment。"""
+        if self.cookie_secure is not None:
+            return self.cookie_secure
+        return self.is_production
+
     @property
     def is_mysql(self) -> bool:
         return "mysql" in self.database_url
diff --git a/backend/app/core/session.py b/backend/app/core/session.py
index 35ebc6f..2f0cb7d 100644
--- a/backend/app/core/session.py
+++ b/backend/app/core/session.py
@@ -68,7 +68,7 @@ def get_cookie_params() -> dict:
         "key": SESSION_COOKIE_NAME,
         "httponly": True,
         "samesite": "lax",
-        "secure": settings.is_production,
+        "secure": settings.use_secure_cookie,
         "max_age": SESSION_TTL_SECONDS,
         "path": "/",
     }
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index c93a0a6..14e7e45 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -15,6 +15,8 @@ services:
     environment:
       ENVIRONMENT: production
       SECRET_KEY: ${SECRET_KEY:-change-me-to-a-real-secret-key}
+      # 站点未配置 HTTPS 时必须为 false，否则浏览器丢弃 Cookie（登录后被踢回登录页）
+      COOKIE_SECURE: "false"
       DATABASE_URL: mysql+pymysql://admin:${MYSQL_PASSWORD:-Lzcc6-01}@host.docker.internal:33306/amb_rag?charset=utf8mb4
       STORAGE_ROOT: /app/data
       DEFAULT_STORAGE_QUOTA: "104857600"