[BUG] 注册用户后无法登录成功

[819345855]

Describe the bug

注册用户后登录，没有任何报错，又返回登录页面无法登录成功
后台日志也未显示任何错误信息

Environment

• OS: 5.7.0-kali1-amd64 Dev 0127 #1 SMP Debian 5.7.6-1kali2 (2020-07-01) x86_64 GNU/Linux
• Browser: CHROME145.0.7632.110
  docker部署

Logs

日志只有后台日志
joysafeter-backend | 2026-02-26 07:32:05 | INFO | trace_id=57d08660-3f74-46a7-92b5-3c6a6f6f71da | POST /api/v1/auth/sign-in/email | app.common.logging:dispatch:33 | request.start
joysafeter-backend | 2026-02-26 07:32:05 | INFO | trace_id=57d08660-3f74-46a7-92b5-3c6a6f6f71da | POST /api/v1/auth/sign-in/email | app.common.logging:dispatch:47 | request.completed status=200 duration=0.255s
joysafeter-backend | INFO: 192.168.137.1:62533 - "POST /api/v1/auth/sign-in/email HTTP/1.1" 200 OK
joysafeter-backend | 2026-02-26 07:32:05 | INFO | trace_id=235079e8-cab8-46e7-a614-89ea008985b6 | GET /api/v1/auth/session | app.common.logging:dispatch:33 | request.start
joysafeter-backend | 2026-02-26 07:32:05 | INFO | trace_id=235079e8-cab8-46e7-a614-89ea008985b6 | GET /api/v1/auth/session | app.common.logging:dispatch:47 | request.completed status=200 duration=0.004s
joysafeter-backend | INFO: 192.168.137.1:62533 - "GET /api/v1/auth/session HTTP/1.1" 200 OK
joysafeter-backend | 2026-02-26 07:32:05 | INFO | trace_id=- | - - | app.services.sandbox_manager:ensure_sandbox_running:107 | Starting sandbox for user 3303ae28-220c-4b86-890c-aa50310ce4a0 (id=98c3f86f-83fe-4f2d-bcd2-ad06c80d79cf)
joysafeter-backend | 2026-02-26 07:32:05 | INFO | trace_id=- | - - | app.core.agent.backends.pydantic_adapter:init:209 | Initializing PydanticSandboxAdapter: id=98c3f86f-83fe-4f2d-bcd2-ad06c80d79cf, image=python:3.12-slim, working_dir=/workspace, volumes=1
joysafeter-backend | 2026-02-26 07:32:05 | INFO | trace_id=- | - - | app.core.agent.backends.pydantic_adapter:init:230 | DockerSandbox created: id=98c3f86f-83fe-4f2d-bcd2-ad06c80d79cf, image=python:3.12-slim
joysafeter-backend | 2026-02-26 07:32:07 | INFO | trace_id=- | - - | app.core.agent.backends.pydantic_adapter:start:269 | Sandbox 98c3f86f-83fe-4f2d-bcd2-ad06c80d79cf started (image=python:3.12-slim)
joysafeter-backend | 2026-02-26 07:32:07 | INFO | trace_id=500b34c4-479f-48c1-97e3-e1889fba69cb | GET /api/v1/auth/session | app.common.logging:dispatch:33 | request.start
joysafeter-backend | 2026-02-26 07:32:07 | INFO | trace_id=500b34c4-479f-48c1-97e3-e1889fba69cb | GET /api/v1/auth/session | app.common.logging:dispatch:47 | request.completed status=200 duration=0.003s
joysafeter-backend | INFO: 192.168.137.1:62533 - "GET /api/v1/auth/session HTTP/1.1" 200 OK
joysafeter-backend | 2026-02-26 07:32:07 | INFO | trace_id=- | - - | app.api.v1.auth:_warm_up_sandbox:89 | Sandbox pre-warming triggered for user 3303ae28-220c-4b86-890c-aa50310ce4a0
joysafeter-backend | 2026-02-26 07:32:07 | INFO | trace_id=670d4b3d-eccb-47ff-815a-cf368eeb0e32 | GET /api/v1/auth/oauth/providers | app.common.logging:dispatch:33 | request.start
joysafeter-backend | 2026-02-26 07:32:07 | INFO | trace_id=- | - - | app.core.oauth.config:load:197 | [OAuthConfig] Loaded 0 OAuth providers
joysafeter-backend | 2026-02-26 07:32:07 | INFO | trace_id=670d4b3d-eccb-47ff-815a-cf368eeb0e32 | GET /api/v1/auth/oauth/providers | app.common.logging:dispatch:47 | request.completed status=200 duration=0.011s
joysafeter-backend | INFO: 192.168.137.1:62533 - "GET /api/v1/auth/oauth/providers HTTP/1.1" 200 OK
joysafeter-backend | 2026-02-26 07:32:10 | INFO | trace_id=693bb85e-4c04-49a2-9002-ae364d729270 | GET / | app.common.logging:dispatch:33 | request.start
joysafeter-backend | 2026-02-26 07:32:10 | INFO | trace_id=693bb85e-4c04-49a2-9002-ae364d729270 | GET / | app.common.logging:dispatch:47 | request.completed status=200 duration=0.001s
joysafeter-backend | INFO: 127.0.0.1:36206 - "GET / HTTP/1.1" 200 OK
joysafeter-db | 2026-02-26 07:32:35.350 UTC [29] LOG: checkpoint starting: timejoysafeter-backend | INFO: 127.0.0.1:36228 - "GET / HTTP/1.1" 200 OK

[yuzzjj]

1.Please confirm whether it is the latest code.
2.Also, please provide the response from the front-end API call

[819345855]

1.Please confirm whether it is the latest code. 2.Also, please provide the response from the front-end API call

代码是2月25日从git下载代码，文件修改日期均是2月12日修改的版本。

GET /chat HTTP/1.1
Host: 192.168.137.131:3000
Accept: /
Connection: keep-alive

HTTP/1.1 200 OK
content-security-policy: default-src 'self' 'nonce-NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj' http://192.168.137.131:* .jd.com http://localhost: http://127.0.0.1:; connect-src 'self' data: mediastream: blob: http://localhost:8000 https://localhost:8000 ws://localhost:8000 wss://localhost:8000 http://192.168.137.131: .jd.com http://localhost: http://127.0.0.1:* http://.jd.com https://.jd.com; script-src 'self' 'nonce-NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj' 'sha256-z0nb1PpkFco8UDVc/Xq/SKYGByn8TQYxeliFAv309DM=' http://192.168.137.131:* .jd.com http://localhost: http://127.0.0.1:* 'strict-dynamic'; style-src 'self' 'unsafe-inline' http://192.168.137.131:* .jd.com http://localhost: http://127.0.0.1:; style-src-attr 'unsafe-inline'; worker-src 'self' blob:; media-src 'self' data: mediastream: blob: http://192.168.137.131: .jd.com http://localhost: http://127.0.0.1:; img-src 'self' data: blob: https://.githubusercontent.com https://*.gravatar.com; font-src 'self' data: blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'none';
permissions-policy: geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-nonce: NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj
x-xss-protection: 1; mode=block
Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
link: </_next/static/media/797e433ab948586e-s.p.dbea232f.woff2>; rel=preload; as="font"; crossorigin=""; nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"; type="font/woff2", </_next/static/media/caa3a2e1cccd8315-s.p.853070df.woff2>; rel=preload; as="font"; crossorigin=""; nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"; type="font/woff2"
X-Powered-By: Next.js
Cache-Control: private, no-cache, no-store, max-age=0, must-revalidate
Content-Type: text/html; charset=utf-8
Date: Fri, 27 Feb 2026 03:06:37 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Content-Length: 24096

<script src="/_next/static/chunks/21db721f6c9ea01e.js" async="" nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"></script><script src="/_next/static/chunks/52bd8fa9b85c441d.js" async="" nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"></script><script src="/_next/static/chunks/7a9e0bcddea219e7.js" async="" nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"></script><script src="/_next/static/chunks/4c50dba615630f39.js" async="" nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"></script><script src="/_next/static/chunks/0b68bcc61534b12b.js" async="" nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"></script><script src="/_next/static/chunks/turbopack-8cbb57d22bb53044.js" async="" nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"></script><script src="/_next/static/chunks/edf9a0ce96680479.js" async="" nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"></script><script src="/_next/static/chunks/01e535205fb18e10.js" async="" nonce="NGM5OWYxNWEtMGQ1OS00YTUwLWFiMDItYjBiYzczODEwNmZj"></script><script src="/_next/static/chunks/497e90105

发现登录只发送了一个上面的请求，没有用户密码的请求接口。

[yuzzjj]

ok, get. will fix

[819345855]

1.Please confirm whether it is the latest code. 2.Also, please provide the response from the front-end API call

后续，调整了一下前端ENV的CSP的策略 加了这个192IP白名单才可以访问后台。

另，前端页面有个控制台报错：
Executing inline script violates the following Content Security Policy directive 'script-src 'self' 'nonce-MTE2ZTc3OTQtZmQyMC00MGFiLThmOTgtNzExMzE2Mjg0YzZm' 'sha256-z0nb1PpkFco8UDVc/Xq/SKYGByn8TQYxeliFAv309DM=' http://192.168.137.131:* .jd.com http://localhost: http://127.0.0.1:* 'strict-dynamic''. Either the 'unsafe-inline' keyword, a hash ('sha256-hweB5ft6P5GckAdddQeQ/oIE/5wsGJGlNDKQmAvF9CU='), or a nonce ('nonce-...') is required to enable inline execution. The action has been blocked.

[Enghao]

我也遇到了 。辛苦官方修复。

[yuzzjj]

fix by #46

[ruur]

@yuzzjj 按照这个MR修改了 connect-src 'self' ${schemeSource} ${backendApiDomains} ${whiteList} http://10.8.33.33:8000 依旧还是不能登录，帮忙看看是什么原因

其中http://10.8.33.33:8000是后端地址

[yuzzjj]

@ruur 使用的最新github镜像
或者 本地编译的
sh deploy/deploy.sh build

[ruur]

@ruur 使用的最新github镜像 或者 本地编译的 sh deploy/deploy.sh build
@yuzzjj
我拉取最新的代码，直接本地运行，也是一样的结果。
这个是http://10.8.xx.xx:8000/api/v1/auth/session 接口的响应结果：
{"success":true,"code":200,"message":"Success","data":{"user":null},"timestamp":"2026-03-03T05:04:03.501879Z"}

另外，前端console里已经没有各种错误提示了。比如CSP这些。

[yuzzjj]

OK，如果没啥问题我就关闭该 issue了啊

[ruur]

OK，如果没啥问题我就关闭该 issue了啊

没有错误提示，但是登录还是会退出。请求里返回的user是null
看了一下session接口的cookie里没有auth_token 这个可能是什么原因呢 如果是locahost就没有问题 但是一旦换成IP就有问题

怀疑是同域的问题，我现在挂上了nginx之后让前后端是一个地址，cookie里仍然没有auth_token