From 45da76cea7d926076f7c93feb75c85ebaff9b3f3 Mon Sep 17 00:00:00 2001
From: chenpei <chenpei@1080p.hk>
Date: Tue, 7 Jul 2026 16:00:43 +0800
Subject: [PATCH] =?UTF-8?q?=E9=80=82=E9=85=8D=E9=92=89=E9=92=89=E7=AB=AF?=
 =?UTF-8?q?=E5=86=85=E5=85=8D=E7=99=BBCookie=E7=AD=96=E7=95=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/dingtalk-login.ts | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/lib/dingtalk-login.ts b/lib/dingtalk-login.ts
index 3a9cbaa..c60439e 100644
--- a/lib/dingtalk-login.ts
+++ b/lib/dingtalk-login.ts
@@ -254,6 +254,9 @@ async function createAuthenticatedResponse(
     avatar?: string | null
     isSuperAdmin?: boolean | null
   },
+  options?: {
+    cookieSameSite?: 'lax' | 'none'
+  },
 ) {
   const secret = process.env.NEXTAUTH_SECRET
   if (!secret) {
@@ -266,6 +269,7 @@ async function createAuthenticatedResponse(
   const cookieNames = secureCookie
     ? getAuthSessionCookieCandidates(true)
     : [cookieName]
+  const sameSite = options?.cookieSameSite === 'none' && secureCookie ? 'none' : 'lax'
   const sessionToken = await encode({
     secret,
     maxAge,
@@ -300,7 +304,7 @@ async function createAuthenticatedResponse(
 
   response.cookies.set(cookieName, sessionToken, {
     httpOnly: true,
-    sameSite: 'lax',
+    sameSite,
     secure: secureCookie,
     path: '/',
     maxAge,
@@ -313,7 +317,7 @@ async function createAuthenticatedResponse(
 
     response.cookies.set(name, sessionToken, {
       httpOnly: true,
-      sameSite: 'lax',
+      sameSite,
       secure: secureCookie,
       path: '/',
       maxAge,
@@ -327,6 +331,9 @@ async function createOrUpdateUserSession(
   request: NextRequest,
   userId: string,
   userInfo: DingtalkUserInfo,
+  options?: {
+    cookieSameSite?: 'lax' | 'none'
+  },
 ) {
   const displayName = String(userInfo.name || '').trim()
   if (!displayName) {
@@ -474,7 +481,7 @@ async function createOrUpdateUserSession(
     managedDepartment: user.managedDepartment,
     avatar: user.avatar,
     isSuperAdmin: (user as any).isSuperAdmin ?? false,
-  })
+  }, options)
 }
 
 function getAppAccessToken(appSource: DingtalkLoginAppSource) {
@@ -669,5 +676,7 @@ export async function loginDingtalkUserByH5AuthCode(
   const userInfo = await getUserInfo(userId, appAccessToken)
   console.log('获取用户信息成功:', userInfo.name)
 
-  return createOrUpdateUserSession(request, userId, userInfo)
+  return createOrUpdateUserSession(request, userId, userInfo, {
+    cookieSameSite: 'none',
+  })
 }