From f884b016cc705bb7365bb73324ddb71ba2f2245b Mon Sep 17 00:00:00 2001
From: "2569718930@qq.com" <2569718930@qq.com>
Date: Tue, 26 May 2026 04:27:37 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=20callback=20=E6=97=A0?=
 =?UTF-8?q?=E9=99=90=E9=87=8D=E5=AE=9A=E5=90=91=EF=BC=9Aorigin=20=E6=AF=94?=
 =?UTF-8?q?=E8=BE=83=E6=94=B9=E4=B8=BA=20host=20header=20=E6=AF=94?=
 =?UTF-8?q?=E8=BE=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

nextUrl.origin 在 route handler 中不认 x-forwarded-* headers，
导致 canonical origin 检查始终失败，callback 无限重定向到自身。
改用 request.headers.get(host) 比较。
---
 frontend/app/auth/callback/route.ts | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/frontend/app/auth/callback/route.ts b/frontend/app/auth/callback/route.ts
index d7df6e5e..c6adec29 100644
--- a/frontend/app/auth/callback/route.ts
+++ b/frontend/app/auth/callback/route.ts
@@ -12,11 +12,15 @@ function normalizeNextPath(input: string | null) {
 }
 
 export async function GET(request: NextRequest) {
-  const configuredSiteUrl = getConfiguredSiteUrl();
-  if (configuredSiteUrl) {
-    const canonicalOrigin = new URL(configuredSiteUrl).origin;
-    if (request.nextUrl.origin !== canonicalOrigin) {
-      const canonicalCallbackUrl = new URL(request.nextUrl.pathname, canonicalOrigin);
+  const siteUrl = getConfiguredSiteUrl();
+  if (siteUrl) {
+    const expectedHost = new URL(siteUrl).host;
+    const requestHost =
+      request.headers.get("x-forwarded-host") ||
+      request.headers.get("host") ||
+      "";
+    if (requestHost !== expectedHost) {
+      const canonicalCallbackUrl = new URL(request.nextUrl.pathname, siteUrl);
       canonicalCallbackUrl.search = request.nextUrl.search;
       return NextResponse.redirect(canonicalCallbackUrl);
     }