1

backend/app/core/config.py

@@ -20,6 +20,9 @@ class Settings(BaseSettings):
     # --- 基础 ---
     environment: str = "local"  # local / production
     secret_key: str = Field(min_length=16)
+    # Cookie Secure 标记：默认跟随 environment（production→Secure）。
+    # 站点还是 HTTP 时必须显式设为 false，否则浏览器丢弃 Cookie 导致登录后立即被踢回。
+    cookie_secure: bool | None = None
 
     # --- 数据库 ---
     database_url: str = "mysql+pymysql://admin:Lzcc6-01@47.109.98.44:33306/amb_rag?charset=utf8mb4"
@@ -42,6 +45,13 @@ class Settings(BaseSettings):
     def is_production(self) -> bool:
         return self.environment == "production"
 
+    @property
+    def use_secure_cookie(self) -> bool:
+        """HTTPS 站点才应启用 Secure Cookie；未显式配置时跟随 environment。"""
+        if self.cookie_secure is not None:
+            return self.cookie_secure
+        return self.is_production
+
     @property
     def is_mysql(self) -> bool:
         return "mysql" in self.database_url