diff --git a/src/app/api/auth/login/oidc/route.ts b/src/app/api/auth/login/oidc/route.ts
index 0c599fe..1c38397 100644
--- a/src/app/api/auth/login/oidc/route.ts
+++ b/src/app/api/auth/login/oidc/route.ts
@@ -18,6 +18,12 @@ export async function GET(request: Request) {
 
   const response = NextResponse.redirect(authorizeUrl)
 
+  // 切换账号时清除旧 session cookie
+  if (switchUser) {
+    response.cookies.set('tlyq_session', '', { maxAge: 0, path: '/' })
+    response.cookies.set('session', '', { maxAge: 0, path: '/' })
+  }
+
   // 存储 PKCE 参数到 httpOnly cookie（5 分钟过期）
   const cookieOpts = { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' as const, maxAge: 300, path: '/' }
   response.cookies.set('oidc_code_verifier', codeVerifier, cookieOpts)
diff --git a/src/app/api/auth/login/route.ts b/src/app/api/auth/login/route.ts
index 7496160..2366dd9 100644
--- a/src/app/api/auth/login/route.ts
+++ b/src/app/api/auth/login/route.ts
@@ -53,7 +53,7 @@ export async function POST(request: NextRequest) {
       user: { username: 'localadmin', role, displayName },
     })
     response.cookies.set('tlyq_session', token, {
-      httpOnly: true, secure: false, sameSite: 'lax', path: '/', maxAge: 604800,
+      httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', path: '/', maxAge: 604800,
     })
     return response
   }
diff --git a/src/lib/permissions.ts b/src/lib/permissions.ts
index 1a12c13..a1f382b 100644
--- a/src/lib/permissions.ts
+++ b/src/lib/permissions.ts
@@ -1,4 +1,6 @@
 // src/lib/permissions.ts — RBAC 权限定义 + 检查函数
+import { verifyJwt } from '@shared/lib/auth/jwt'
+import { authConfig } from '@/lib/auth-config'
 export const PERMISSIONS = [
   { key: 'dashboard:view', name: '查看仪表盘' },
   { key: 'services:view', name: '查看服务列表' },
@@ -28,15 +30,12 @@ export function hasPermission(role: string, permissionKey: string): boolean {
   return perms ? perms.includes(permissionKey) : false
 }
 
-// API 服务端权限检查（从 cookie 中读取 role）
+// API 服务端权限检查（从 cookie 中读取 role，验证 JWT 签名）
 export function checkPermission(request: { cookies: { get(name: string): { value: string } | undefined } }, permissionKey: string): boolean {
   const token = request.cookies.get('tlyq_session')?.value
   if (!token) return false
-  try {
-    const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString())
-    const role = payload.role || 'viewer'
-    return hasPermission(role, permissionKey)
-  } catch {
-    return false
-  }
+  const payload = verifyJwt(token, authConfig.jwtSecret)
+  if (!payload) return false
+  const role = (payload.role as string) || 'viewer'
+  return hasPermission(role, permissionKey)
 }