登陆来源无效问题如何更好解决

* 描述问题

登陆时提示登陆来源无效,询问豆包后,只能在compose文件中增加两条配置 才能登陆,
‘- TRUST_PROXY=true - CORS_ORIGIN_WHITELIST=https://192.168.1.200:8070’
但是不能把所有的地址都设置为白名单这样也太复杂了。

* 运行环境

  • NocoBase 版本:2.2.31
  • 数据库种类与版本: 18.1-alpine
  • 部署方式: Docker部署
  • Docker 镜像版本:nocobase/nocobase:2.2.31

日志

{“level”:“error”,“message”:“登录来源无效”,“extra”:{“method”:“error-handler”,“err”:“ForbiddenError: 登录来源无效\n at Object.throw (/app/nocobase/node_modules/koa/lib/context.js:96:11)\n at assertTrustedSignInOrigin (/app/nocobase/node_modules/@nocobase/auth/lib/actions.js:45:16)\n at signIn (/app/nocobase/node_modules/@nocobase/auth/lib/actions.js:75:5)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at triggerWorkflowActionMiddleware (/app/nocobase/node_modules/@nocobase/plugin-workflow-action-trigger/dist/server/ActionTrigger.js:73:13)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at verificationMiddleware (/app/nocobase/node_modules/@nocobase/plugin-verification/dist/server/verification-manager.js:214:16)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at /app/nocobase/node_modules/@nocobase/plugin-ui-templates/dist/server/plugin.js:184:16\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at blockChinaRegionList (/app/nocobase/node_modules/@nocobase/plugin-field-china-region/dist/server/index.js:57:15)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at /app/nocobase/node_modules/@nocobase/plugin-locale-tester/dist/server/plugin.js:71:13\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at setMainDepartment (/app/nocobase/node_modules/@nocobase/plugin-departments/dist/server/middlewares/set-main-department.js:55:9)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at resetUserDepartmentsCache (/app/nocobase/node_modules/@nocobase/plugin-departments/dist/server/middlewares/reset-user-departments-cache.js:33:9)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at updateDepartmentIsLeaf (/app/nocobase/node_modules/@nocobase/plugin-departments/dist/server/middlewares/update-department-isleaf.js:88:10)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at destroyDepartmentCheck (/app/nocobase/node_modules/@nocobase/plugin-departments/dist/server/middlewares/destroy-department-check.js:57:9)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)”},“meta”:{“err”:“ForbiddenError: 登录来源无效\n at Object.throw (/app/nocobase/node_modules/koa/lib/context.js:96:11)\n at assertTrustedSignInOrigin (/app/nocobase/node_modules/@nocobase/auth/lib/actions.js:45:16)\n at signIn (/app/nocobase/node_modules/@nocobase/auth/lib/actions.js:75:5)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at triggerWorkflowActionMiddleware (/app/nocobase/node_modules/@nocobase/plugin-workflow-action-trigger/dist/server/ActionTrigger.js:73:13)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at verificationMiddleware (/app/nocobase/node_modules/@nocobase/plugin-verification/dist/server/verification-manager.js:214:16)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at /app/nocobase/node_modules/@nocobase/plugin-ui-templates/dist/server/plugin.js:184:16\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at blockChinaRegionList (/app/nocobase/node_modules/@nocobase/plugin-field-china-region/dist/server/index.js:57:15)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at /app/nocobase/node_modules/@nocobase/plugin-locale-tester/dist/server/plugin.js:71:13\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at setMainDepartment (/app/nocobase/node_modules/@nocobase/plugin-departments/dist/server/middlewares/set-main-department.js:55:9)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at resetUserDepartmentsCache (/app/nocobase/node_modules/@nocobase/plugin-departments/dist/server/middlewares/reset-user-departments-cache.js:33:9)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at updateDepartmentIsLeaf (/app/nocobase/node_modules/@nocobase/plugin-departments/dist/server/middlewares/update-department-isleaf.js:88:10)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)\n at destroyDepartmentCheck (/app/nocobase/node_modules/@nocobase/plugin-departments/dist/server/middlewares/destroy-department-check.js:57:9)\n at dispatch (/app/nocobase/node_modules/koa-compose/index.js:42:32)”},“module”:“auth”,“submodule”:“signIn”,“method”:“error-handler”,“app”:“main”,“reqId”:“a9879b69-3acc-4a40-9f85-7be5e83284b1”,“dataSourceKey”:“main”,“timestamp”:“2026-10-26 11:44:34”}

“登录来源无效”是 2.2 起的校验:服务端比对浏览器 Origin 与自识别的协议+域名+端口,不一致即 403。若 https://192.168.1.200:8070 走反向代理,请在代理加 X-Forwarded-Proto $scheme 与 Host $host 头,任意地址都算同源,不必逐个加白名单;TRUST_PROXY 并非 NocoBase 变量。确需跨源再把页面来源加入 CORS_ORIGIN_WHITELIST。NocoBase 环境变量配置 - NocoBase 文档