fix(auth): 修复局域网 HTTP 环境登录后被重定向回登录页

[katelya77]

Issue

Fixes #203

??

Docker ??? NODE_ENV=production ????????? NODE_ENV=production ?? HTTPS ?????HTTP ??? IP ??? HTTP IP ????????????? Secure Cookie??????? HTTP ?????? Cookie????????? /?proxy.ts ??? auth Cookie????? 307 ? /login?redirect=/????????????????

Issue ????????? ECONNRESET??????????????? Cookie ??????HTTPS ??????HTTP localhost/?? IP ??????? Secure Cookie ? HTTP IP ??????

????

• ?? src/lib/request-protocol.ts???????????? HTTP/HTTPS????
  • req.nextUrl.protocol
  • X-Forwarded-Proto
  • ????????????? https, http
  • ?? Forwarded: proto=https
  • ???????????
• ?? src/lib/auth-cookie.ts?????/?? Cookie ??????
• ??????????????/?? auth Cookie?
• Cookie ???? SameSite=Lax?????????? Secure?
• ?????? CORS??? Access-Control-Allow-Origin: * ? Access-Control-Allow-Credentials: true ????????? Origin ???? credentials CORS ??
• ?? src/lib/safe-redirect.ts???? redirect ???????????? URL????? URL ? javascript:?
• ?? README ? Docker/???????

????

• src/lib/request-protocol.ts
• src/lib/auth-cookie.ts
• src/lib/safe-redirect.ts
• src/app/api/login/route.ts
• src/app/api/logout/route.ts
• src/app/login/page.tsx
• __tests__/auth-cookie.test.js
• __tests__/auth-routes.test.js
• README.md

HTTP/HTTPS Cookie ??

??	Secure	SameSite	??
HTTP IP	false	Lax	?????/?? HTTP IP ????
HTTP localhost	false	Lax	??????? localhost Secure Cookie ?????
HTTPS ??	true	Lax	HTTPS ????? Secure
HTTPS ??	true	Lax	X-Forwarded-Proto: https ? Forwarded: proto=https ??? Secure
HTTP ??	false	Lax	X-Forwarded-Proto: http ???? Secure

???? SameSite=None + Secure=false?

????

???????

• Docker production + HTTP ??? IP??? 200?Cookie ?? Secure???? Cookie ????? 307?
• HTTP localhost??? Cookie ?? Secure????????
• HTTPS ???Cookie ? Secure?
• HTTPS ?????X-Forwarded-Proto: https ? Cookie ? Secure?
• ?????X-Forwarded-Proto: https, http ??????
• HTTP ???X-Forwarded-Proto: http ? Cookie ?? Secure?
• Forwarded: proto=https ????
• localstorage ???
• kvrocks ???? owner ?????????
• kvrocks ????????????
• redis/upstash owner ?????
• HTTP/HTTPS logout Cookie ????? path ???
• ???????????????
• redirect ????? /?/search?q=test?/play?source=x&id=1????? URL?// ? javascript:?
• public ???????????????????
• ?? CORS ???? wildcard + credentials?

??????????

• pnpm test -- __tests__/auth-cookie.test.js __tests__/auth-routes.test.js --runInBand????31 passed?
• pnpm typecheck????
• pnpm test --runInBand????13 suites / 70 tests passed?
• pnpm lint???????? next lint ? Next.js 16.1.0 ??????? lint?? Invalid project directory provided?
• pnpm lint:strict????eslint --max-warnings=0 src?
• pnpm exec prettier -c README.md src/app/api/login/route.ts src/app/api/logout/route.ts src/app/login/page.tsx src/lib/auth-cookie.ts src/lib/request-protocol.ts src/lib/safe-redirect.ts __tests__/auth-cookie.test.js __tests__/auth-routes.test.js????
• pnpm build????

?????????

• pnpm start ?? Node fetch ?? http://127.0.0.1:3000/api/login?HTTP Cookie ?? Secure?
• ?? Host: 192.168.1.20:3000?HTTP Cookie ?? Secure?
• ?? X-Forwarded-Proto: https?Cookie ? Secure?
• ? HTTP ?? Cookie ?? /??? 200?
• ?? Cookie ?? /??? 307 ? /login?redirect=%2F?

?????

• ??????????
• ??? httpOnly=false?????????????????
• ????????? public/admin ???
• SameSite ??? Lax??????? fetch('/api/login') ???????? HTTP IP?localhost?HTTPS ??? PWA ?????
• ???? HTTPS ???????? X-Forwarded-Proto?

????

??? PR ??????????????????? HTTP IP ?? Docker ??????????????? Cookie ????????

[Copilot]

Pull request overview

This PR fixes an authentication regression where Docker production deployments accessed via LAN HTTP (e.g. http://192.168.x.x) would set Secure auth cookies and cause users to be redirected back to the login page after logging in.

Changes:

• Introduces shared request protocol/origin detection (X-Forwarded-Proto, Forwarded, fallback to nextUrl.protocol) and uses it to decide whether to set Secure on the auth cookie.
• Centralizes auth cookie options (name, expiry, SameSite=Lax, secure detection) and applies them consistently in login/logout routes.
• Hardens login redirect handling via a safe redirect helper and updates docs + adds targeted Jest coverage for the HTTP/HTTPS/proxy cases and CORS behavior.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/lib/request-protocol.ts	Adds effective protocol/host/origin helpers for direct and proxied requests.
src/lib/auth-cookie.ts	Centralizes auth cookie name/options; sets Secure based on effective protocol.
src/lib/safe-redirect.ts	Adds safe redirect-path validation to avoid unsafe redirect targets.
src/app/api/login/route.ts	Uses shared cookie helpers; tightens CORS to same-origin only; removes NODE_ENV-based HTTPS assumption.
src/app/api/logout/route.ts	Clears auth cookie using shared clear-options derived from request protocol.
src/app/login/page.tsx	Uses safe redirect helper before router.replace.
__tests__/auth-cookie.test.js	Adds unit tests for protocol detection, cookie flags, and safe redirects.
__tests__/auth-routes.test.js	Adds integration-style tests covering login/logout cookie behavior and proxy redirect behavior.
README.md	Documents LAN HTTP support and correct reverse-proxy headers (not relying on NODE_ENV).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.