diff --git a/src/app/api/auth/callback/route.ts b/src/app/api/auth/callback/route.ts
index a4edcbd..dfd99d2 100644
--- a/src/app/api/auth/callback/route.ts
+++ b/src/app/api/auth/callback/route.ts
@@ -13,24 +13,27 @@ export async function GET(request: NextRequest) {
   const state = searchParams.get('state')
   const error = searchParams.get('error')
 
+  // 使用 OIDC_REDIRECT_URI 构造公共 URL（LESSONS-LEARNED #16）
+  const baseUrl = authConfig.oidcRedirectUri?.replace(/\/api\/auth\/callback.*/, '') || 'http://localhost:6181'
+
   if (error) {
-    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(error)}`, request.url))
+    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(error)}`, baseUrl))
   }
 
   if (!code || !state) {
-    return NextResponse.redirect(new URL('/login?error=missing_params', request.url))
+    return NextResponse.redirect(new URL('/login?error=missing_params', baseUrl))
   }
 
   // 验证 state
   const savedState = request.cookies.get('oidc_state')?.value
   if (!savedState || savedState !== state) {
-    return NextResponse.redirect(new URL('/login?error=state_mismatch', request.url))
+    return NextResponse.redirect(new URL('/login?error=state_mismatch', baseUrl))
   }
 
   // 取出 code_verifier
   const codeVerifier = request.cookies.get('oidc_code_verifier')?.value
   if (!codeVerifier) {
-    return NextResponse.redirect(new URL('/login?error=missing_verifier', request.url))
+    return NextResponse.redirect(new URL('/login?error=missing_verifier', baseUrl))
   }
 
   // 换取 token
@@ -40,13 +43,13 @@ export async function GET(request: NextRequest) {
   )
 
   if (!tokenResult.success) {
-    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(tokenResult.error || 'token_exchange_failed')}`, request.url))
+    return NextResponse.redirect(new URL(`/login?error=${encodeURIComponent(tokenResult.error || 'token_exchange_failed')}`, baseUrl))
   }
 
   // 验证 nonce
   const savedNonce = request.cookies.get('oidc_nonce')?.value
   if (savedNonce && tokenResult.nonce && savedNonce !== tokenResult.nonce) {
-    return NextResponse.redirect(new URL('/login?error=nonce_mismatch', request.url))
+    return NextResponse.redirect(new URL('/login?error=nonce_mismatch', baseUrl))
   }
 
   // 获取 userinfo
@@ -74,9 +77,6 @@ export async function GET(request: NextRequest) {
     payload: { username: userinfo.preferred_username, displayName: userinfo.name, role: user.role },
   })
 
-  // 使用 OIDC_REDIRECT_URI 构造公共 URL（LESSONS-LEARNED #16）
-  const baseUrl = authConfig.oidcRedirectUri?.replace(/\/api\/auth\/callback.*/, '') || 'http://localhost:6181'
-
   const response = NextResponse.redirect(new URL('/', baseUrl))
 
   // 签发 tlyq_session cookie