diff --git a/src/app/api/admin/users/[id]/route.ts b/src/app/api/admin/users/[id]/route.ts
index ff9e0ab..01e3fa5 100644
--- a/src/app/api/admin/users/[id]/route.ts
+++ b/src/app/api/admin/users/[id]/route.ts
@@ -35,6 +35,11 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
     if (existing[0].username === 'admin' || existing[0].username === 'localadmin') {
       return NextResponse.json({ error: '不能修改系统保留用户的角色' }, { status: 400 })
     }
+    // role 白名单校验
+    const validRoles = ['admin', 'editor', 'viewer']
+    if (!validRoles.includes(role)) {
+      return NextResponse.json({ error: `无效角色，允许值: ${validRoles.join(', ')}` }, { status: 400 })
+    }
     updates.push(`role = '${role.replace(/'/g, "''")}'`)
     details.role = role
   }
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index 2366dd9..e57f03f 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -88,7 +88,7 @@ export async function POST(request: NextRequest) {
     user: { username, role, displayName: result.displayName || username },
   })
   response.cookies.set('tlyq_session', token, {
-    httpOnly: true, secure: false, sameSite: 'lax', domain: authConfig.cookieDomain, path: '/', maxAge: 604800,
+    httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', domain: authConfig.cookieDomain, path: '/', maxAge: 604800,
   })
   return response
 }