内网部署登陆成功后访问 dashboard 报错 307

[b19g3r]

Request URL http://192.168.110.50:23000/zh-CN/dashboard?_rsc=1ypk9
Request Method GET
Status Code 307 Temporary Redirect
Remote Address 192.168.110.50:23000
Referrer Policy strict-origin-when-cross-origin

内网部署登陆成功后访问 dashboard 报错 307,页面一直显示登录中

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• login成功但是无法跳转到dashboard #466

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[ding113]

如http部署，按照登录页提示配置允许不安全的环境变量后需要down再up整个compose。

或您可以考虑https部署以解决此问题。

[github-actions]

Thank you for reporting this issue.

Root Cause Analysis:

Based on the codebase investigation, the 307 redirect is caused by a secure cookie configuration mismatch in your HTTP (intranet) deployment environment.

The issue flow:

1. Login succeeds on the server side
2. Auth cookie is set with secure: true (because ENABLE_SECURE_COOKIES=true by default)
3. Browser rejects storing/sending secure cookies over HTTP (non-HTTPS)
4. Dashboard request is made without the auth cookie
5. Dashboard layout checks for session, finds none, and redirects (307) to login

Key code locations:

• src/lib/config/env.schema.ts (line 95): ENABLE_SECURE_COOKIES defaults to true
• src/lib/auth.ts (lines 241-251): Cookie is set with secure: env.ENABLE_SECURE_COOKIES
• src/app/[locale]/dashboard/layout.tsx (lines 19-23): Session check triggers redirect when no session found

Solution:

For HTTP (intranet) deployments, set this environment variable:

ENABLE_SECURE_COOKIES=false

This is documented in .env.example (lines 48-52):

# Cookie 安全策略
# - true (默认)：仅允许 HTTPS 传输 Cookie，浏览器会自动放行 localhost 的 HTTP
# - false：允许 HTTP 传输 Cookie（会降低安全性，仅推荐用于内网部署）
# 警告：若设置为 true 且使用远程 HTTP 访问，浏览器将拒绝设置 Cookie 导致无法登录
ENABLE_SECURE_COOKIES=true

To apply:

1. Add ENABLE_SECURE_COOKIES=false to your environment configuration
2. Restart the application
3. Clear browser cookies and try logging in again

Security Note: Setting ENABLE_SECURE_COOKIES=false reduces security. It is recommended only for trusted intranet environments. For production deployments, consider using HTTPS with proper TLS certificates.

---

Automated response from Claude AI

[b19g3r]

收到了 感谢 我的问题