From 7a6cea3da1b66b024e6d10b0643fbdcdd37587cb Mon Sep 17 00:00:00 2001
From: LIghtJUNction <lightjunction.me@gmail.com>
Date: Sat, 28 Mar 2026 12:27:52 +0800
Subject: [PATCH] fix(dashboard): remove Authorization header and
 withCredentials from SSE connections

SSE connections to /api/live-log are same-origin (VITE_API_BASE is empty
in production, resolves to relative /api path). The Authorization header
and withCredentials:true triggered CORS preflight (OPTIONS) requests,
but the SSE route only handles GET, causing the preflight to fail.
---
 dashboard/src/components/shared/ConsoleDisplayer.vue | 6 ------
 dashboard/src/components/shared/TraceDisplayer.vue   | 6 ------
 2 files changed, 12 deletions(-)

diff --git a/dashboard/src/components/shared/ConsoleDisplayer.vue b/dashboard/src/components/shared/ConsoleDisplayer.vue
index e37e1e2f3..d3f54a1bf 100644
--- a/dashboard/src/components/shared/ConsoleDisplayer.vue
+++ b/dashboard/src/components/shared/ConsoleDisplayer.vue
@@ -123,16 +123,10 @@ export default {
 
       console.log(`正在连接日志流... (尝试次数: ${this.retryAttempts})`);
 
-      const token = localStorage.getItem("token");
-
       this.eventSource = new EventSourcePolyfill(
         resolveApiUrl("/api/live-log"),
         {
-          headers: {
-            Authorization: token ? `Bearer ${token}` : "",
-          },
           heartbeatTimeout: 300000,
-          withCredentials: true,
         },
       );
 
diff --git a/dashboard/src/components/shared/TraceDisplayer.vue b/dashboard/src/components/shared/TraceDisplayer.vue
index 9264567be..913299426 100644
--- a/dashboard/src/components/shared/TraceDisplayer.vue
+++ b/dashboard/src/components/shared/TraceDisplayer.vue
@@ -180,16 +180,10 @@ export default {
         this.eventSource = null;
       }
 
-      const token = localStorage.getItem("token");
-
       this.eventSource = new EventSourcePolyfill(
         resolveApiUrl("/api/live-log"),
         {
-          headers: {
-            Authorization: token ? `Bearer ${token}` : "",
-          },
           heartbeatTimeout: 300000,
-          withCredentials: true,
         },
       );