1

backend/app/core/config.py

@@ -20,6 +20,9 @@ class Settings(BaseSettings):
     # --- 基础 ---
     environment: str = "local"  # local / production
     secret_key: str = Field(min_length=16)
+    # Cookie Secure 标记：默认跟随 environment（production→Secure）。
+    # 站点还是 HTTP 时必须显式设为 false，否则浏览器丢弃 Cookie 导致登录后立即被踢回。
+    cookie_secure: bool | None = None
 
     # --- 数据库 ---
     database_url: str = "mysql+pymysql://admin:Lzcc6-01@47.109.98.44:33306/amb_rag?charset=utf8mb4"
@@ -42,6 +45,13 @@ class Settings(BaseSettings):
     def is_production(self) -> bool:
         return self.environment == "production"
 
+    @property
+    def use_secure_cookie(self) -> bool:
+        """HTTPS 站点才应启用 Secure Cookie；未显式配置时跟随 environment。"""
+        if self.cookie_secure is not None:
+            return self.cookie_secure
+        return self.is_production
+
     @property
     def is_mysql(self) -> bool:
         return "mysql" in self.database_url

backend/app/core/session.py

@@ -68,7 +68,7 @@ def get_cookie_params() -> dict:
         "key": SESSION_COOKIE_NAME,
         "httponly": True,
         "samesite": "lax",
-        "secure": settings.is_production,
+        "secure": settings.use_secure_cookie,
         "max_age": SESSION_TTL_SECONDS,
         "path": "/",
     }