Medusa JS服务器端管理面板401认证错误求助

我已将Medusa JS部署在Digital Ocean云服务器上，使用Nginx作为反向代理。本地运行npm start后访问http://localhost:9000/app管理面板一切正常，但在服务器端使用相同环境变量操作时，登录后会被重定向回登录页面，且出现401错误。

我的环境变量如下：

DATABASE_TYPE=postgres
DATABASE_URL=postgresql://.....
JWT_SECRET=bVra...
COOKIE_SECRET=J31X...
NPM_CONFIG_PRODUCTION=false
YARN_PRODUCTION=false
NODE_ENV=production

另外，调用普通Store API（如https://api.everydayoptics.in/store/products）可正常返回数据。我使用的是同域名下的默认管理面板，因此排除CORS问题。以下是我的Nginx配置：

server {
      listen 80;
      listen [::]:80;
      server_name everydayoptics.in www.everydayoptics.in api.everydayoptics.in;
      return 301 https://$host$request_uri;
  }

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name www.everydayoptics.in;

    ssl_certificate /etc/letsencrypt/live/everydayoptics.in/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/everydayoptics.in/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    return 301 https://everydayoptics.in$request_uri;
}

server {

    server_name everydayoptics.in;

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/everydayoptics.in/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/everydayoptics.in/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    location / {
        try_files $uri $uri/ =404;
    }

}

server {
    server_name api.everydayoptics.in;

    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/everydayoptics.in/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/everydayoptics.in/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    location / {
        proxy_pass http://localhost:9000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }

}

解决方法 #

1. 补全Nginx代理的Cookie与头部配置 #

当前Nginx配置缺少认证Cookie传递和安全头部设置，导致登录后认证信息无法正确同步到Medusa服务。修改api.everydayoptics.in的server块中location部分：

location / {
    proxy_pass http://localhost:9000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    # 传递客户端Cookie
    proxy_set_header Cookie $http_cookie;
    proxy_cache_bypass $http_upgrade;
    # 强制Cookie使用安全属性
    proxy_cookie_path / "/; secure; HttpOnly; SameSite=Strict";
}

2. 添加生产环境Cookie专属环境变量 #

在服务器环境变量中补充以下配置，确保Medusa生成的Cookie符合HTTPS环境要求：

ADMIN_COOKIE_SECURE=true
ADMIN_COOKIE_SAME_SITE=Strict
ADMIN_COOKIE_DOMAIN=.everydayoptics.in

• ADMIN_COOKIE_SECURE：限制Cookie仅通过HTTPS传输
• ADMIN_COOKIE_SAME_SITE：阻止跨站Cookie泄露
• ADMIN_COOKIE_DOMAIN：设置根域名，确保子域名下的管理面板能识别Cookie

3. 确认生产环境依赖完整性 #

虽然设置了NODE_ENV=production，但NPM_CONFIG_PRODUCTION=false可能导致依赖未按生产环境标准安装。执行以下命令后重启服务：

npm install --production

4. 清除浏览器缓存与Cookie #

浏览器可能缓存了旧的无效认证数据，清除api.everydayoptics.in域名的Cookie和缓存后，重新尝试登录。

内容的提问来源于stack exchange，提问作者Nehal Ahmad