From 62dffb782a7112163dddb204ce42a866c95c4262 Mon Sep 17 00:00:00 2001 From: selfrelease Date: Thu, 25 Jun 2026 21:14:05 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E7=94=9F=E4=BA=A7?= =?UTF-8?q?=E7=8E=AF=E5=A2=83=20CORS=20=E9=94=99=E8=AF=AF=20-=20SSR=20?= =?UTF-8?q?=E4=BD=BF=E7=94=A8=20API=5FURL=20=E8=80=8C=E9=9D=9E=20NEXT=5FPU?= =?UTF-8?q?BLIC=5FAPI=5FURL?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 将登录页 SSR 获取组织列表改为读取 API_URL 环境变量 - 避免 NEXT_PUBLIC_* 变量泄露到客户端导致跨域请求 localhost - 客户端 api.ts 已使用空字符串（same-origin 通过 nginx 代理） --- apps/web/src/app/(auth)/login/page.tsx | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apps/web/src/app/(auth)/login/page.tsx b/apps/web/src/app/(auth)/login/page.tsx index b77ca0e..e054cbf 100644 --- a/apps/web/src/app/(auth)/login/page.tsx +++ b/apps/web/src/app/(auth)/login/page.tsx @@ -7,7 +7,8 @@ import LoginForm from "./login-form"; export const dynamic = "force-dynamic"; async function getOrganizations(): Promise { - const base = process.env.NEXT_PUBLIC_API_URL || "http://localhost:8080"; + // 服务端 SSR 用内网地址，不使用 NEXT_PUBLIC_* 避免泄露到客户端 + const base = process.env.API_URL || "http://localhost:8080"; try { const res = await fetch(`${base}/api/v1/organizations`, { cache: "no-store",