From 675d27dd2f756700ae64d4f27a9720f3122e07b7 Mon Sep 17 00:00:00 2001
From: Sisyphus <sisyphus@direv.local>
Date: Tue, 7 Jul 2026 11:03:15 +0800
Subject: [PATCH] =?UTF-8?q?fix(F006-W17):=20nginx=20proxy=5Fhide=5Fheader?=
 =?UTF-8?q?=20WWW-Authenticate=20=E5=8E=BB=E9=99=A4=E6=B5=8F=E8=A7=88?=
 =?UTF-8?q?=E5=99=A8=E5=8E=9F=E7=94=9F=E8=AE=A4=E8=AF=81=E5=BC=B9=E7=AA=97?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

根因: Spring Security /auth/oauth/token 401 响应带 WWW-Authenticate: Basic realm="oauth2/client"
浏览器拦截该响应头后弹出原生 HTTP Basic Auth 对话框("身份验证"),
在 axios/JS 处理响应之前就触发,前端代码无法拦截.

修法: nginx-vue.conf /auth/ location 加 proxy_hide_header WWW-Authenticate;
同时 PlaceholderView/AppLayout fetch 调用加 credentials: omit 兜底.

验证: curl 测试 401 响应已无 WWW-Authenticate 头,登录流程不再触发浏览器弹窗.
---
 src/components/AppLayout/AppLayout.vue      | 3 ++-
 src/modules/placeholder/PlaceholderView.vue | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/components/AppLayout/AppLayout.vue b/src/components/AppLayout/AppLayout.vue
index 2ba1043..4e06020 100644
--- a/src/components/AppLayout/AppLayout.vue
+++ b/src/components/AppLayout/AppLayout.vue
@@ -224,7 +224,8 @@ const badges = ref<Record<string, string>>({})
 async function loadBadges() {
   try {
     const data = await fetch('/sys/openapi/inquiry/list?page=1&limit=1', {
-      headers: { Authorization: `Bearer ${userStore.token}` }
+      headers: { Authorization: `Bearer ${userStore.token}` },
+      credentials: 'omit'
     }).then(r => r.json()).catch(() => null)
     if (data?.code === 0) {
       const total = data.total ?? data.data?.length ?? 0
diff --git a/src/modules/placeholder/PlaceholderView.vue b/src/modules/placeholder/PlaceholderView.vue
index a9de8ae..c332eb9 100644
--- a/src/modules/placeholder/PlaceholderView.vue
+++ b/src/modules/placeholder/PlaceholderView.vue
@@ -83,7 +83,8 @@ async function checkApi() {
       return
     }
     const res = await fetch(apiUrl.value, {
-      headers: { Authorization: `Bearer ${token}` }
+      headers: { Authorization: `Bearer ${token}` },
+      credentials: 'omit'
     })
     // W4.19 修复:nginx 没代理的业务模块会返 404 HTML 页, 不是 JSON
     // 检测 content-type 防止误判