From c5d8db2647724029dab5a1a3cfb9eb779a5ac366 Mon Sep 17 00:00:00 2001
From: hardy <2545433047@qq.com>
Date: Tue, 15 Sep 2026 15:49:29 +0800
Subject: [PATCH 1/4] feat(TAP-11883): send auth via Bearer instead of URL
 tokens

Stop appending access_token to REST, download, WS, and SSO URLs.
Use Authorization Bearer, blob downloads, PDK icon object URLs,
SAML login_code exchange, and keepalive fetch on data-preview unload.
---
 apps/daas/src/main.ts                         | 16 +++++-
 apps/daas/src/plugins/axios.ts                | 55 ++++++++++++-------
 apps/daas/src/views/api-page/ApiServer.vue    |  8 +--
 apps/daas/src/views/login/SsoCallback.vue     | 41 +++++++++++---
 packages/api/src/JavascriptFunctions.ts       |  9 ++-
 packages/api/src/Modules.js                   | 16 +++---
 packages/api/src/PythonFunctions.ts           |  9 ++-
 packages/api/src/Task.ts                      |  9 ++-
 packages/api/src/Users.ts                     |  4 +-
 packages/api/src/core/connections.ts          |  7 ++-
 packages/api/src/core/function.ts             |  5 +-
 packages/api/src/core/javascript-functions.ts |  5 +-
 packages/api/src/core/metadata-instances.ts   |  7 +--
 packages/api/src/core/modules.ts              | 10 ++--
 packages/api/src/core/python-functions.ts     |  5 +-
 packages/api/src/core/sso.ts                  | 11 +++-
 packages/api/src/core/task.ts                 |  7 ++-
 packages/api/src/core/users.ts                |  6 +-
 packages/api/src/download.ts                  | 12 ++++
 packages/api/src/index.ts                     |  1 +
 .../business/src/components/logs/Download.vue |  9 +--
 .../business/src/views/connections/util.js    | 52 ++++++++++++------
 .../business/src/views/data-server/Debug.vue  |  9 ++-
 .../src/views/data-server/template.ts         | 26 +++++----
 packages/dag/src/composables/useFormScope.ts  | 10 ++--
 packages/dag/src/data-capture/DataCapture.vue | 18 ++++--
 packages/dag/src/mixins/formScope.js          | 15 +++--
 27 files changed, 242 insertions(+), 140 deletions(-)
 create mode 100644 packages/api/src/download.ts

diff --git a/apps/daas/src/main.ts b/apps/daas/src/main.ts
index 66f17344f5..068235e39d 100644
--- a/apps/daas/src/main.ts
+++ b/apps/daas/src/main.ts
@@ -71,6 +71,17 @@ const URL_LANG = getUrlSearch('lang')
 
 if (TOKEN) {
   Cookie.set('access_token', TOKEN)
+  const [hashPath, hashQuery] = location.hash.split('?')
+  if (hashQuery) {
+    const params = new URLSearchParams(hashQuery)
+    params.delete('token')
+    const nextHash = params.toString() ? `${hashPath}?${params}` : hashPath
+    history.replaceState(
+      null,
+      '',
+      `${location.pathname}${location.search}${nextHash}`,
+    )
+  }
 }
 
 const token = Cookie.get('access_token')
@@ -100,9 +111,8 @@ const init = () => {
 
   app.config.globalProperties.$ws = new WSClient(wsUrl, undefined, {
     getQuery: () => {
-      return {
-        access_token: Cookie.get('access_token'),
-      }
+      // Same-origin WS sends the access_token cookie; do not put the token in the URL (TAP-11883).
+      return {}
     },
   })
 
diff --git a/apps/daas/src/plugins/axios.ts b/apps/daas/src/plugins/axios.ts
index 3dc5484346..3afb7a320a 100644
--- a/apps/daas/src/plugins/axios.ts
+++ b/apps/daas/src/plugins/axios.ts
@@ -19,6 +19,7 @@ import { signOut } from '../utils/util'
 
 type AxiosRequestConfigPro = AxiosRequestConfig & {
   silenceMessage?: boolean
+  skipAuthExpire?: boolean
 }
 
 // Pending requests map for cancellation
@@ -60,6 +61,9 @@ const errorCallback = (error: any): Promise<any> => {
     switch (rsp.status) {
       // 用户无权限访问接口
       case 401: {
+        if ((error.config as AxiosRequestConfigPro)?.skipAuthExpire) {
+          break
+        }
         const isSingleSession = getSettingByKey('login.single.session', 'open')
 
         signOut()
@@ -114,6 +118,35 @@ const errorCallback = (error: any): Promise<any> => {
   return Promise.reject(error)
 }
 
+function stripUrlAccessToken(url?: string) {
+  if (!url) {
+    return url
+  }
+  let next = url.replaceAll(/([?&])access_token=[^&]*/gi, '$1')
+  next = next.replaceAll('?&', '?').replaceAll('&&', '&')
+  if (next.endsWith('?') || next.endsWith('&')) {
+    next = next.slice(0, -1)
+  }
+  return next
+}
+
+function applyBearerAuth(config: InternalAxiosRequestConfig) {
+  const accessToken = Cookie.get('access_token')
+  if (accessToken) {
+    config.headers = config.headers || {}
+    if (!config.headers.Authorization) {
+      config.headers.Authorization = `Bearer ${accessToken}`
+    }
+  }
+  if (config.url) {
+    config.url = stripUrlAccessToken(config.url)
+  }
+  if (config.params && typeof config.params === 'object') {
+    delete (config.params as Record<string, unknown>).access_token
+  }
+  return config
+}
+
 axios.interceptors.request.use(function (
   config: InternalAxiosRequestConfig,
 ): InternalAxiosRequestConfig {
@@ -123,16 +156,7 @@ axios.interceptors.request.use(function (
       encoder: (str) => window.encodeURIComponent(str),
     })
   }
-  const accessToken = Cookie.get('access_token')
-  if (accessToken && config.url) {
-    if (~config.url.indexOf('?')) {
-      if (!~config.url.indexOf('access_token')) {
-        config.url = `${config.url}&access_token=${accessToken}`
-      }
-    } else {
-      config.url = `${config.url}?access_token=${accessToken}`
-    }
-  }
+  applyBearerAuth(config)
   if (config.headers) {
     config.headers['x-requested-with'] = 'XMLHttpRequest'
   }
@@ -170,16 +194,7 @@ export function initRequestClient() {
   requestClient.addRequestInterceptor({
     synchronous: true,
     fulfilled: (config) => {
-      const accessToken = Cookie.get('access_token')
-      if (accessToken) {
-        if (config.url?.indexOf?.('?') !== -1) {
-          if (config.url?.indexOf?.('access_token') === -1) {
-            config.url = `${config.url}&access_token=${accessToken}`
-          }
-        } else {
-          config.url = `${config.url}?access_token=${accessToken}`
-        }
-      }
+      applyBearerAuth(config)
       if (isPassiveScope()) {
         config.headers = config.headers || {}
         config.headers['X-User-Activity'] = '0'
diff --git a/apps/daas/src/views/api-page/ApiServer.vue b/apps/daas/src/views/api-page/ApiServer.vue
index 6767c24936..507018808d 100644
--- a/apps/daas/src/views/api-page/ApiServer.vue
+++ b/apps/daas/src/views/api-page/ApiServer.vue
@@ -9,8 +9,8 @@ import {
 import PageContainer from '@tap/business/src/components/PageContainer.vue'
 import TablePage from '@tap/business/src/components/TablePage.vue'
 import { useHas } from '@tap/business/src/composables'
+import { downloadAuthenticated } from '@tap/api/src/download'
 import i18n from '@tap/i18n'
-import Cookie from '@tap/shared/src/cookie'
 import { ElMessage, ElMessageBox } from 'element-plus'
 import { escapeRegExp } from 'lodash-es'
 import { h, nextTick, reactive, ref } from 'vue'
@@ -113,11 +113,7 @@ const remove = (item: Record<string, any>) => {
 
 // 下载api配置文件
 const downloadConfig = (item: Record<string, any>) => {
-  const token = Cookie.get('access_token')
-  window.open(
-    `${API_SERVER_BASE_URL}/download/${item.id}?access_token=${token}`,
-    '_blank',
-  )
+  downloadAuthenticated(`${API_SERVER_BASE_URL}/download/${item.id}`)
 }
 
 // 保存
diff --git a/apps/daas/src/views/login/SsoCallback.vue b/apps/daas/src/views/login/SsoCallback.vue
index 84bdd82d6f..29372d46e6 100644
--- a/apps/daas/src/views/login/SsoCallback.vue
+++ b/apps/daas/src/views/login/SsoCallback.vue
@@ -1,5 +1,6 @@
 <script>
 import { fetchSettings } from '@tap/api/core/settings'
+import { exchangeSsoLoginCode } from '@tap/api/src/core/sso'
 import { getUserInfoByToken } from '@tap/api/src/core/users'
 import Cookie from '@tap/shared/src/cookie'
 import { setSettings } from '@tap/shared/src/settings'
@@ -21,15 +22,24 @@ export default {
   },
   methods: {
     async handleCallback() {
-      // The SAML ACS success redirect lands here with ?access_token=XXX appended
-      // to the hash route. Convert that URL token into a cookie and run the same
-      // post-login bootstrap as the password path before the router guard runs.
-      const accessToken = getUrlSearch('access_token')
-      if (!accessToken) {
-        this.redirectToLogin()
-        return
-      }
+      // SAML ACS redirects here with a one-time login_code (TAP-11883).
+      // COMPAT: still accept a legacy ?access_token= and immediately move it into a cookie.
+      const loginCode = getUrlSearch('login_code')
+      const legacyToken = getUrlSearch('access_token')
+      let accessToken = ''
       try {
+        if (loginCode) {
+          const exchanged = await exchangeSsoLoginCode(loginCode)
+          accessToken =
+            typeof exchanged === 'string' ? exchanged : exchanged?.id
+        } else if (legacyToken) {
+          accessToken = legacyToken
+        }
+        if (!accessToken) {
+          this.redirectToLogin()
+          return
+        }
+        this.stripAuthParamsFromUrl()
         Cookie.set('access_token', accessToken)
         Cookie.set('tem_token', accessToken)
         // Mark the session so logout can trigger SP-initiated SLO.
@@ -60,6 +70,21 @@ export default {
         this.redirectToLogin(error?.message)
       }
     },
+    stripAuthParamsFromUrl() {
+      const [hashPath, hashQuery] = location.hash.split('?')
+      if (!hashQuery) {
+        return
+      }
+      const params = new URLSearchParams(hashQuery)
+      params.delete('access_token')
+      params.delete('login_code')
+      const nextHash = params.toString() ? `${hashPath}?${params}` : hashPath
+      history.replaceState(
+        null,
+        '',
+        `${location.pathname}${location.search}${nextHash}`,
+      )
+    },
     redirectToLogin(message) {
       Cookie.remove('access_token')
       Cookie.remove('tem_token')
diff --git a/packages/api/src/JavascriptFunctions.ts b/packages/api/src/JavascriptFunctions.ts
index 8c74034fb9..a2e9d70008 100644
--- a/packages/api/src/JavascriptFunctions.ts
+++ b/packages/api/src/JavascriptFunctions.ts
@@ -1,4 +1,4 @@
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from './download'
 import Http from './Http'
 
 export default class JavascriptFunctions extends Http {
@@ -6,10 +6,9 @@ export default class JavascriptFunctions extends Http {
     super('/api/Javascript_functions')
   }
   export(ids) {
-    const href = `${
-      this.url
-    }/batch/load?id=${ids.join('&id=')}&access_token=${Cookie.get('access_token')}`
-    window.open(href)
+    return downloadAuthenticated(
+      `${this.url}/batch/load?id=${ids.join('&id=')}`,
+    )
   }
 }
 export { JavascriptFunctions }
diff --git a/packages/api/src/Modules.js b/packages/api/src/Modules.js
index 62fffcc9e0..77a640b0fb 100644
--- a/packages/api/src/Modules.js
+++ b/packages/api/src/Modules.js
@@ -1,4 +1,4 @@
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from './download'
 import Http from './Http'
 
 export default class Modules extends Http {
@@ -50,17 +50,15 @@ export default class Modules extends Http {
   }
 
   export(ids) {
-    const href = `${
-      this.url
-    }/batch/load?id=${ids.join('&id=')}&access_token=${Cookie.get('access_token')}`
-    window.open(href)
+    return downloadAuthenticated(
+      `${this.url}/batch/load?id=${ids.join('&id=')}`,
+    )
   }
 
   apiExport(ids, ip) {
-    const href = `${
-      this.url
-    }/api/export?id=${ids.join('&id=')}&access_token=${Cookie.get('access_token')}&ip=${ip}`
-    window.open(href)
+    return downloadAuthenticated(
+      `${this.url}/api/export?id=${ids.join('&id=')}&ip=${ip}`,
+    )
   }
 
   updatePermissions(data) {
diff --git a/packages/api/src/PythonFunctions.ts b/packages/api/src/PythonFunctions.ts
index ef25c4e021..2f33b5bc9f 100644
--- a/packages/api/src/PythonFunctions.ts
+++ b/packages/api/src/PythonFunctions.ts
@@ -1,4 +1,4 @@
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from './download'
 import Http from './Http'
 
 export default class PythonFunctions extends Http {
@@ -6,10 +6,9 @@ export default class PythonFunctions extends Http {
     super('/api/python-functions')
   }
   export(ids) {
-    const href = `${
-      this.url
-    }/batch/load?id=${ids.join('&id=')}&access_token=${Cookie.get('access_token')}`
-    window.open(href)
+    return downloadAuthenticated(
+      `${this.url}/batch/load?id=${ids.join('&id=')}`,
+    )
   }
 }
 export { PythonFunctions }
diff --git a/packages/api/src/Task.ts b/packages/api/src/Task.ts
index f1cfbc8d82..bc2bb01d22 100644
--- a/packages/api/src/Task.ts
+++ b/packages/api/src/Task.ts
@@ -1,6 +1,6 @@
 import { isPlainObj } from '@tap/shared'
-import Cookie from '@tap/shared/src/cookie'
 import qs from 'qs'
+import { downloadAuthenticated } from './download'
 import Http from './Http'
 
 export default class Task extends Http {
@@ -81,10 +81,9 @@ export default class Task extends Http {
   }
 
   export(ids) {
-    const href = `${
-      this.url
-    }/batch/load?taskId=${ids.join('&taskId=')}&access_token=${Cookie.get('access_token')}`
-    window.open(href)
+    return downloadAuthenticated(
+      `${this.url}/batch/load?taskId=${ids.join('&taskId=')}`,
+    )
   }
   checkRun(id) {
     return this.axios.get(`${this.url}/checkRun/${id}`)
diff --git a/packages/api/src/Users.ts b/packages/api/src/Users.ts
index d1893fda25..fbb42a19dc 100644
--- a/packages/api/src/Users.ts
+++ b/packages/api/src/Users.ts
@@ -44,7 +44,9 @@ export default class Users extends Http {
   }
 
   newResetPassword(token) {
-    return this.axios.post(`${this.url}/newResetPassword?access_token=${token}`)
+    return this.axios.post(`${this.url}/newResetPassword`, undefined, {
+      headers: { Authorization: `Bearer ${token}` },
+    })
   }
 
   confirm(id, token) {
diff --git a/packages/api/src/core/connections.ts b/packages/api/src/core/connections.ts
index 0a58ef3c6c..1abef289b5 100644
--- a/packages/api/src/core/connections.ts
+++ b/packages/api/src/core/connections.ts
@@ -1,4 +1,4 @@
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from '../download'
 import { requestClient, type Filter } from '../request'
 
 const BASE_URL = '/api/Connections'
@@ -115,8 +115,9 @@ export function findOneConnection(params: any) {
 }
 
 export function exportConnections(ids: string[]) {
-  const href = `${BASE_URL}/batch/load?connectionId=${ids.join('&connectionId=')}&access_token=${Cookie.get('access_token')}`
-  window.open(href)
+  return downloadAuthenticated(
+    `${BASE_URL}/batch/load?connectionId=${ids.join('&connectionId=')}`,
+  )
 }
 
 export function uploadConnections(data: any) {
diff --git a/packages/api/src/core/function.ts b/packages/api/src/core/function.ts
index 93452cc153..1fcaec0133 100644
--- a/packages/api/src/core/function.ts
+++ b/packages/api/src/core/function.ts
@@ -1,4 +1,4 @@
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from '../download'
 import { requestClient } from '../request'
 
 const BASE_URL = '/api/Javascript_functions'
@@ -53,8 +53,7 @@ export function updateFunction(where: any, attributes: any) {
 }
 
 export function exportFunctions(ids: string[]) {
-  const href = `${BASE_URL}/batch/load?id=${ids.join('&id=')}&access_token=${Cookie.get('access_token')}`
-  window.open(href)
+  return downloadAuthenticated(`${BASE_URL}/batch/load?id=${ids.join('&id=')}`)
 }
 
 export function uploadFunctions(data: any) {
diff --git a/packages/api/src/core/javascript-functions.ts b/packages/api/src/core/javascript-functions.ts
index 8a1cb846b5..ec37410859 100644
--- a/packages/api/src/core/javascript-functions.ts
+++ b/packages/api/src/core/javascript-functions.ts
@@ -1,8 +1,7 @@
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from '../download'
 
 const BASE_URL = '/api/Javascript_functions'
 
 export function exportJavascriptFunctions(ids: string[]) {
-  const href = `${BASE_URL}/batch/load?id=${ids.join('&id=')}&access_token=${Cookie.get('access_token')}`
-  window.open(href)
+  return downloadAuthenticated(`${BASE_URL}/batch/load?id=${ids.join('&id=')}`)
 }
diff --git a/packages/api/src/core/metadata-instances.ts b/packages/api/src/core/metadata-instances.ts
index 7b7719c0a5..e81319a0bd 100644
--- a/packages/api/src/core/metadata-instances.ts
+++ b/packages/api/src/core/metadata-instances.ts
@@ -1,4 +1,4 @@
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from '../download'
 import { requestClient, type PageFetchResult } from '../request'
 
 const BASE_URL = '/api/MetadataInstances'
@@ -17,9 +17,8 @@ export function updateMetadataInstanceClassification(params: any) {
 
 export function downloadMetadataInstance(where: any, type: string) {
   if (typeof where === 'object') where = JSON.stringify(where)
-  const accessToken = Cookie.get('access_token') as string | undefined
-  window.open(
-    `${BASE_URL}/download?where=${encodeURIComponent(where)}&type=${type}&access_token=${encodeURIComponent(accessToken || '')}`,
+  return downloadAuthenticated(
+    `${BASE_URL}/download?where=${encodeURIComponent(where)}&type=${type}`,
   )
 }
 
diff --git a/packages/api/src/core/modules.ts b/packages/api/src/core/modules.ts
index 22f0311343..edba9e19c6 100644
--- a/packages/api/src/core/modules.ts
+++ b/packages/api/src/core/modules.ts
@@ -1,4 +1,4 @@
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from '../download'
 import { requestClient } from '../request'
 
 const BASE_URL = '/api/Modules'
@@ -148,16 +148,16 @@ export function getApiModuleList(params: any) {
  * 导出 API 模块 - 批量导出模块配置
  */
 export function exportApiModules(ids: string[]) {
-  const href = `${BASE_URL}/batch/load?id=${ids.join('&id=')}&access_token=${Cookie.get('access_token')}`
-  window.open(href)
+  return downloadAuthenticated(`${BASE_URL}/batch/load?id=${ids.join('&id=')}`)
 }
 
 /**
  * 导出 API 文档 - 导出 API 接口文档
  */
 export function exportApiDocumentation(ids: string[], ip: string) {
-  const href = `${BASE_URL}/api/export?id=${ids.join('&id=')}&access_token=${Cookie.get('access_token')}&ip=${ip}`
-  window.open(href)
+  return downloadAuthenticated(
+    `${BASE_URL}/api/export?id=${ids.join('&id=')}&ip=${ip}`,
+  )
 }
 
 /**
diff --git a/packages/api/src/core/python-functions.ts b/packages/api/src/core/python-functions.ts
index 23e3de99fa..cb81bf60ac 100644
--- a/packages/api/src/core/python-functions.ts
+++ b/packages/api/src/core/python-functions.ts
@@ -1,4 +1,4 @@
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from '../download'
 import { requestClient } from '../request'
 
 const BASE_URL = '/api/python-functions'
@@ -10,6 +10,5 @@ export function fetchPythonFunctions(filter?: any) {
 }
 
 export function exportPythonFunctions(ids: string[]) {
-  const href = `${BASE_URL}/batch/load?id=${ids.join('&id=')}&access_token=${Cookie.get('access_token')}`
-  window.open(href)
+  return downloadAuthenticated(`${BASE_URL}/batch/load?id=${ids.join('&id=')}`)
 }
diff --git a/packages/api/src/core/sso.ts b/packages/api/src/core/sso.ts
index 933d11caed..72ae3ef7a3 100644
--- a/packages/api/src/core/sso.ts
+++ b/packages/api/src/core/sso.ts
@@ -19,7 +19,7 @@ export function checkSamlLoginEnable() {
  * Absolute URL that starts SP-initiated SAML login. The browser must navigate
  * to it directly (window.location) so the IdP redirect chain runs in the tab;
  * on success the backend redirects back to the SSO_CALLBACK_RELAY_STATE route
- * with an access_token query param appended.
+ * with a one-time login_code query param (TAP-11883).
  */
 export function getSamlLoginUrl() {
   return `${SSO_BASE_URL}/login?relayState=${encodeURIComponent(
@@ -27,6 +27,13 @@ export function getSamlLoginUrl() {
   )}`
 }
 
+/** Exchange the one-time SSO login_code for a session access token. */
+export function exchangeSsoLoginCode(loginCode: string) {
+  return requestClient.post<{ id: string }>(`${SSO_BASE_URL}/exchange`, {
+    login_code: loginCode,
+  })
+}
+
 /**
  * Absolute URL for SP-initiated Single Logout. The browser must navigate to it
  * directly; the backend terminates the local session, then redirects to the IdP
@@ -34,6 +41,8 @@ export function getSamlLoginUrl() {
  */
 export function getSamlLogoutUrl(accessToken?: string) {
   const relay = `relayState=${encodeURIComponent(SSO_LOGOUT_RELAY_STATE)}`
+  // Browser navigation cannot set Authorization. TM GET /logout still reads
+  // optional access_token to find the SAML session for IdP SLO (COMPAT).
   return accessToken
     ? `${SSO_BASE_URL}/logout?access_token=${encodeURIComponent(accessToken)}&${relay}`
     : `${SSO_BASE_URL}/logout?${relay}`
diff --git a/packages/api/src/core/task.ts b/packages/api/src/core/task.ts
index 97888b3df1..ec1706f618 100644
--- a/packages/api/src/core/task.ts
+++ b/packages/api/src/core/task.ts
@@ -1,5 +1,5 @@
 import { isPlainObj } from '@tap/shared'
-import Cookie from '@tap/shared/src/cookie'
+import { downloadAuthenticated } from '../download'
 import { requestClient, type Page } from '../request'
 
 const BASE_URL = '/api/Task'
@@ -131,8 +131,9 @@ export function editTask(params: any) {
 }
 
 export function exportTasks(ids: string[]) {
-  const href = `${BASE_URL}/batch/load?taskId=${ids.join('&taskId=')}&access_token=${Cookie.get('access_token')}`
-  window.open(href)
+  return downloadAuthenticated(
+    `${BASE_URL}/batch/load?taskId=${ids.join('&taskId=')}`,
+  )
 }
 
 export function checkTaskRun(id: string) {
diff --git a/packages/api/src/core/users.ts b/packages/api/src/core/users.ts
index d1dd80f2c5..a9364f9ad8 100644
--- a/packages/api/src/core/users.ts
+++ b/packages/api/src/core/users.ts
@@ -45,9 +45,9 @@ export function checkToken() {
 }
 
 export function newResetPassword(token: string) {
-  return requestClient.post(
-    `${BASE_URL}/newResetPassword?access_token=${token}`,
-  )
+  return requestClient.post(`${BASE_URL}/newResetPassword`, undefined, {
+    headers: { Authorization: `Bearer ${token}` },
+  })
 }
 
 export function confirmUser(id: string, token: string) {
diff --git a/packages/api/src/download.ts b/packages/api/src/download.ts
new file mode 100644
index 0000000000..cca7e312b4
--- /dev/null
+++ b/packages/api/src/download.ts
@@ -0,0 +1,12 @@
+import { downloadBlob } from '@tap/shared'
+import axios from 'axios'
+
+/**
+ * Download a same-origin TM/API file with Authorization: Bearer.
+ * Do not put the session token in the URL (TAP-11883).
+ */
+export function downloadAuthenticated(url: string, filename?: string) {
+  return axios.get(url, { responseType: 'blob' }).then((res) => {
+    downloadBlob(res, filename)
+  })
+}
diff --git a/packages/api/src/index.ts b/packages/api/src/index.ts
index 0548d2f2d5..101ad1e231 100644
--- a/packages/api/src/index.ts
+++ b/packages/api/src/index.ts
@@ -5,6 +5,7 @@ export { CancelToken, isCancel }
 export default Http
 
 export * from './request'
+export { downloadAuthenticated } from './download'
 // export * from './core'
 
 export { useRequest } from 'vue-request'
diff --git a/packages/business/src/components/logs/Download.vue b/packages/business/src/components/logs/Download.vue
index e4e7d0acfc..cf3bc210cb 100644
--- a/packages/business/src/components/logs/Download.vue
+++ b/packages/business/src/components/logs/Download.vue
@@ -1,8 +1,8 @@
 <script>
 import { callProxy } from '@tap/api/src/core/proxy'
+import { downloadAuthenticated } from '@tap/api/src/download'
 import i18n from '@tap/i18n'
 import { calcUnit } from '@tap/shared'
-import Cookie from '@tap/shared/src/cookie'
 import axios from 'axios'
 import { dayjs } from '../../shared'
 
@@ -53,9 +53,10 @@ export default {
         )
 
       if (this.isDaas) {
-        const accessToken = Cookie.get('access_token')
-        url += `&access_token=${accessToken}`
-      } else if (TAP_ACCESS_TOKEN) {
+        downloadAuthenticated(url)
+        return
+      }
+      if (TAP_ACCESS_TOKEN) {
         url += `&__token=${TAP_ACCESS_TOKEN}`
       }
 
diff --git a/packages/business/src/views/connections/util.js b/packages/business/src/views/connections/util.js
index 16f6e9cb3b..1c0ae0e7b5 100644
--- a/packages/business/src/views/connections/util.js
+++ b/packages/business/src/views/connections/util.js
@@ -1,7 +1,5 @@
-import Cookie from '@tap/shared/src/cookie'
 import axios from 'axios'
-
-import qs from 'qs'
+import { reactive } from 'vue'
 
 export const getImgByType = function (type) {
   if (!type || type === 'jira') {
@@ -64,22 +62,42 @@ export const defaultModel = {
   },
 }
 
-// 数据源图标
+// 数据源图标：<img src> 无法带 Authorization，用 Bearer 拉 blob 再转 object URL（TAP-11883）。
+const iconUrlMap = reactive({})
+const iconPending = new Set()
+
 export const getConnectionIcon = (pdkHash) => {
-  if (pdkHash) {
-    const params = {
-      pdkHash,
-    }
-    if (TAP_ACCESS_TOKEN) {
-      params.__token = TAP_ACCESS_TOKEN
-    }
-    const access_token = Cookie.get('access_token')
-    if (access_token) {
-      params.access_token = access_token
+  if (!pdkHash) {
+    return ''
+  }
+  const cached = iconUrlMap[pdkHash]
+  if (cached) {
+    return cached
+  }
+  if (!iconPending.has(pdkHash)) {
+    iconPending.add(pdkHash)
+    const params = { pdkHash }
+    const cloudToken = globalThis.TAP_ACCESS_TOKEN
+    if (cloudToken) {
+      params.__token = cloudToken
     }
     const baseUrl = axios.defaults.baseURL.replace(/\/$/, '')
-    return `${baseUrl}/api/pdk/icon?${qs.stringify(params)}`
-  } else {
-    return ''
+    axios
+      .get(`${baseUrl}/api/pdk/icon`, {
+        params,
+        responseType: 'blob',
+        skipAuthExpire: true,
+        silenceMessage: true,
+      })
+      .then((res) => {
+        const blob = res.data
+        if (blob && blob.size) {
+          iconUrlMap[pdkHash] = URL.createObjectURL(blob)
+        }
+      })
+      .finally(() => {
+        iconPending.delete(pdkHash)
+      })
   }
+  return iconUrlMap[pdkHash] || ''
 }
diff --git a/packages/business/src/views/data-server/Debug.vue b/packages/business/src/views/data-server/Debug.vue
index 973c549603..073edbda87 100644
--- a/packages/business/src/views/data-server/Debug.vue
+++ b/packages/business/src/views/data-server/Debug.vue
@@ -155,12 +155,15 @@ const debugData = async () => {
     return
   }
   const hostPath = urlsMap.value[debugMethod.value]?.replace(/\/$/, '') || ''
-  const url = `${hostPath}?access_token=${token.value.access_token}`
+  const url = hostPath
   const queryBody = {
     apiId: form.value.id,
     url: null,
     method,
-    headers: { 'Content-Type': 'application/json' },
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token.value.access_token}`,
+    },
     body: null,
     params: null,
   }
@@ -185,7 +188,7 @@ const debugData = async () => {
           }
         })
         //@ts-ignore
-        queryBody.url = `${url}${paramsStr}`
+        queryBody.url = paramsStr ? `${url}?${paramsStr.slice(1)}` : url
         queryBody.params = params
         break
       case 'POST':
diff --git a/packages/business/src/views/data-server/template.ts b/packages/business/src/views/data-server/template.ts
index 1151684ab4..dccfb28885 100644
--- a/packages/business/src/views/data-server/template.ts
+++ b/packages/business/src/views/data-server/template.ts
@@ -51,11 +51,11 @@ export default function ({ urlList, token }: TemplateParams) {
 public static String doGet(String url, String access_token, String param) {
   try (CloseableHttpClient httpClient = HttpClients.createDefault()) {
     StringBuilder urlBuilder = new StringBuilder(url);
-    urlBuilder.append("?access_token=").append(access_token);
     if (param != null && !param.isEmpty()) {
-      urlBuilder.append("&filter=").append(URLEncoder.encode(param, StandardCharsets.UTF_8.name()));
+      urlBuilder.append("?filter=").append(URLEncoder.encode(param, StandardCharsets.UTF_8.name()));
     }
     HttpGet httpGet = new HttpGet(urlBuilder.toString());
+    httpGet.setHeader("Authorization", "Bearer " + access_token);
     RequestConfig requestConfig = RequestConfig.custom().setConnectTimeout(5000)
       .setConnectionRequestTimeout(5000)
       .setSocketTimeout(15000).build();
@@ -79,12 +79,11 @@ public static String doGet(String url, String access_token, String param) {
 
 public static String doPost(String url, String access_token, String reqBody) {
   try (CloseableHttpClient httpClient = HttpClients.createDefault()) {
-    StringBuilder urlBuilder = new StringBuilder(url);
-    urlBuilder.append("?access_token=").append(access_token);
     RequestConfig requestConfig = RequestConfig.custom().setConnectTimeout(5000)
       .setConnectionRequestTimeout(5000)
       .setSocketTimeout(15000).build();
-    HttpPost httpPost = new HttpPost(urlBuilder.toString());
+    HttpPost httpPost = new HttpPost(url);
+    httpPost.setHeader("Authorization", "Bearer " + access_token);
     httpPost.setHeader("content-type", "application/json;charset=UTF-8");
     httpPost.setConfig(requestConfig);
     httpPost.setEntity(new StringEntity(reqBody, Charset.defaultCharset()));
@@ -160,17 +159,22 @@ async function getAccessToken(clientId, clientSecret) {
 
 // GET request
 async function get(url, token) {
-  const response = await fetch(url + '?access_token=' + token);
+  const response = await fetch(url, {
+    headers: { Authorization: 'Bearer ' + token }
+  });
   const data = await response.json();
   return data;
 }
 
 // POST request
 async function post(url, token, body) {
-  const response = await fetch(url + '?access_token=' + token, {
+  const response = await fetch(url, {
     method: 'POST',
     body: JSON.stringify(body),
-    headers: { 'Content-Type': 'application/json' }
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: 'Bearer ' + token
+    }
   });
   const data = await response.json();
   return data;
@@ -222,18 +226,18 @@ def get_access_token(client_id, client_secret):
 
 # GET request example
 params = {'page': 1, 'limit': 20}  # Optional query parameters
-headers = {'access_token': access_token}
+headers = {'Authorization': 'Bearer ' + access_token}
 result1 = requests.get(get_url, params=params, headers=headers)
 print('GET result:', result1.text)
 
 # POST request example
 body = {'page': 1, 'limit': 20}
-result2 = requests.post(post_url + '?access_token=' + access_token, json=body)
+result2 = requests.post(post_url, json=body, headers=headers)
 print('POST result:', result2.text)
 
 # Example: Get new token and make request
 # new_token = get_access_token('your_client_id', 'your_client_secret')
-# result = requests.get(get_url, headers={'access_token': new_token})
+# result = requests.get(get_url, headers={'Authorization': 'Bearer ' + new_token})
 # print('Result with new token:', result.text)`
 
   return {
diff --git a/packages/dag/src/composables/useFormScope.ts b/packages/dag/src/composables/useFormScope.ts
index 45c1ab716f..47204f0fee 100644
--- a/packages/dag/src/composables/useFormScope.ts
+++ b/packages/dag/src/composables/useFormScope.ts
@@ -15,12 +15,13 @@ import {
   getNodeSchemaPage,
 } from '@tap/api/src/core/metadata-instances'
 import { commandProxy } from '@tap/api/src/core/proxy'
+import { downloadAuthenticated } from '@tap/api/src/download'
 import { getNodeTableInfo } from '@tap/api/src/core/task'
 import { CONNECTION_STATUS_MAP } from '@tap/business/src/shared'
 import { mapFieldsData } from '@tap/form/src/components/field-select'
 import { FormTab } from '@tap/form/src/components/form-tab'
 import { useI18n } from '@tap/i18n'
-import { Cookie, isPlainObj } from '@tap/shared'
+import { isPlainObj } from '@tap/shared'
 import axios from 'axios'
 import { isEmpty, merge } from 'lodash-es'
 import { computed, reactive, watch } from 'vue'
@@ -1233,9 +1234,10 @@ export function useFormScope({ canvasRef }) {
       let url = `${axios.defaults.baseURL}api/foreignKeyConstraint/load?taskId=${this.dataflow.id}`
 
       if (isDaas) {
-        const accessToken = Cookie.get('access_token')
-        url += `&access_token=${accessToken}`
-      } else if (TAP_ACCESS_TOKEN) {
+        downloadAuthenticated(url)
+        return
+      }
+      if (TAP_ACCESS_TOKEN) {
         url += `&__token=${TAP_ACCESS_TOKEN}`
       }
 
diff --git a/packages/dag/src/data-capture/DataCapture.vue b/packages/dag/src/data-capture/DataCapture.vue
index 30a2c5d8ce..ee0f8bb132 100644
--- a/packages/dag/src/data-capture/DataCapture.vue
+++ b/packages/dag/src/data-capture/DataCapture.vue
@@ -467,7 +467,6 @@ export default defineComponent({
     }
 
     const closeCapture = () => {
-      // 使用 sendBeacon 发送请求
       const body = {
         className: 'CatchDataService',
         method: 'closeCatchData',
@@ -479,11 +478,18 @@ export default defineComponent({
       }
       const blob = new Blob([JSON.stringify(body)], headers)
       const accessToken = Cookie.get('access_token')
-
-      return navigator.sendBeacon(
-        `${axios.defaults.baseURL}api/proxy/call?access_token=${accessToken}`,
-        blob,
-      )
+      const headersInit = {
+        'Content-Type': 'application/json',
+      }
+      if (accessToken) {
+        headersInit.Authorization = `Bearer ${accessToken}`
+      }
+      return fetch(`${axios.defaults.baseURL}api/proxy/call`, {
+        method: 'POST',
+        body: blob,
+        keepalive: true,
+        headers: headersInit,
+      })
     }
 
     const { run, cancel, loading } = usePollingRequest(loadData, {
diff --git a/packages/dag/src/mixins/formScope.js b/packages/dag/src/mixins/formScope.js
index 8695639093..848de9e59d 100644
--- a/packages/dag/src/mixins/formScope.js
+++ b/packages/dag/src/mixins/formScope.js
@@ -15,12 +15,13 @@ import {
   getNodeSchemaPage,
 } from '@tap/api/src/core/metadata-instances'
 import { commandProxy } from '@tap/api/src/core/proxy'
+import { downloadAuthenticated } from '@tap/api/src/download'
 import { getNodeTableInfo } from '@tap/api/src/core/task'
 import { CONNECTION_STATUS_MAP } from '@tap/business/src/shared'
 import { mapFieldsData } from '@tap/form/src/components/field-select'
 import { FormTab } from '@tap/form/src/components/form-tab'
 import i18n from '@tap/i18n'
-import { Cookie, isPlainObj } from '@tap/shared'
+import { isPlainObj } from '@tap/shared'
 import axios from 'axios'
 import { isEmpty, isEqual, merge } from 'lodash-es'
 import { mapGetters, mapState } from 'vuex'
@@ -177,7 +178,10 @@ export default {
           while (parentId) {
             parent = this.scope.findNodeById(parentId)
             if (!parent) {
-              console.error(i18n.t('packages_dag_mixins_formscope_liuyipar'), parentId) // eslint-disable-line
+              console.error(
+                i18n.t('packages_dag_mixins_formscope_liuyipar'),
+                parentId,
+              ) // eslint-disable-line
             }
             parentId = parent?.$inputs?.[0]
           }
@@ -1276,9 +1280,10 @@ export default {
           let url = `${axios.defaults.baseURL}api/foreignKeyConstraint/load?taskId=${this.dataflow.id}`
 
           if (this.isDaas) {
-            const accessToken = Cookie.get('access_token')
-            url += `&access_token=${accessToken}`
-          } else if (TAP_ACCESS_TOKEN) {
+            downloadAuthenticated(url)
+            return
+          }
+          if (TAP_ACCESS_TOKEN) {
             url += `&__token=${TAP_ACCESS_TOKEN}`
           }
 

From d99e48b305595e6d67254f19343932b8e584928c Mon Sep 17 00:00:00 2001
From: hardy <2545433047@qq.com>
Date: Wed, 16 Sep 2026 16:24:30 +0800
Subject: [PATCH 2/4] revert(TAP-11883): read SAML callback access_token from
 URL

Match restored TM ACS redirect; still strip the token from the
address bar after copying it into the session cookie.
---
 apps/daas/src/views/login/SsoCallback.vue | 26 +++++++----------------
 packages/api/src/core/sso.ts              |  9 +-------
 2 files changed, 9 insertions(+), 26 deletions(-)

diff --git a/apps/daas/src/views/login/SsoCallback.vue b/apps/daas/src/views/login/SsoCallback.vue
index 29372d46e6..576f969b86 100644
--- a/apps/daas/src/views/login/SsoCallback.vue
+++ b/apps/daas/src/views/login/SsoCallback.vue
@@ -1,6 +1,5 @@
 <script>
 import { fetchSettings } from '@tap/api/core/settings'
-import { exchangeSsoLoginCode } from '@tap/api/src/core/sso'
 import { getUserInfoByToken } from '@tap/api/src/core/users'
 import Cookie from '@tap/shared/src/cookie'
 import { setSettings } from '@tap/shared/src/settings'
@@ -22,23 +21,15 @@ export default {
   },
   methods: {
     async handleCallback() {
-      // SAML ACS redirects here with a one-time login_code (TAP-11883).
-      // COMPAT: still accept a legacy ?access_token= and immediately move it into a cookie.
-      const loginCode = getUrlSearch('login_code')
-      const legacyToken = getUrlSearch('access_token')
-      let accessToken = ''
+      // The SAML ACS success redirect lands here with ?access_token=XXX appended
+      // to the hash route. Convert that URL token into a cookie and run the same
+      // post-login bootstrap as the password path before the router guard runs.
+      const accessToken = getUrlSearch('access_token')
+      if (!accessToken) {
+        this.redirectToLogin()
+        return
+      }
       try {
-        if (loginCode) {
-          const exchanged = await exchangeSsoLoginCode(loginCode)
-          accessToken =
-            typeof exchanged === 'string' ? exchanged : exchanged?.id
-        } else if (legacyToken) {
-          accessToken = legacyToken
-        }
-        if (!accessToken) {
-          this.redirectToLogin()
-          return
-        }
         this.stripAuthParamsFromUrl()
         Cookie.set('access_token', accessToken)
         Cookie.set('tem_token', accessToken)
@@ -77,7 +68,6 @@ export default {
       }
       const params = new URLSearchParams(hashQuery)
       params.delete('access_token')
-      params.delete('login_code')
       const nextHash = params.toString() ? `${hashPath}?${params}` : hashPath
       history.replaceState(
         null,
diff --git a/packages/api/src/core/sso.ts b/packages/api/src/core/sso.ts
index 72ae3ef7a3..12e09063bf 100644
--- a/packages/api/src/core/sso.ts
+++ b/packages/api/src/core/sso.ts
@@ -19,7 +19,7 @@ export function checkSamlLoginEnable() {
  * Absolute URL that starts SP-initiated SAML login. The browser must navigate
  * to it directly (window.location) so the IdP redirect chain runs in the tab;
  * on success the backend redirects back to the SSO_CALLBACK_RELAY_STATE route
- * with a one-time login_code query param (TAP-11883).
+ * with an access_token query param appended.
  */
 export function getSamlLoginUrl() {
   return `${SSO_BASE_URL}/login?relayState=${encodeURIComponent(
@@ -27,13 +27,6 @@ export function getSamlLoginUrl() {
   )}`
 }
 
-/** Exchange the one-time SSO login_code for a session access token. */
-export function exchangeSsoLoginCode(loginCode: string) {
-  return requestClient.post<{ id: string }>(`${SSO_BASE_URL}/exchange`, {
-    login_code: loginCode,
-  })
-}
-
 /**
  * Absolute URL for SP-initiated Single Logout. The browser must navigate to it
  * directly; the backend terminates the local session, then redirects to the IdP

From 33542e20b9fd6c2cedd3d5fb21e918717a208bf6 Mon Sep 17 00:00:00 2001
From: hardy <2545433047@qq.com>
Date: Wed, 16 Sep 2026 17:21:03 +0800
Subject: [PATCH 3/4] revert(TAP-11883): restore SAML ACS access_token redirect

---
 apps/daas/src/views/login/SsoCallback.vue | 15 ---------------
 packages/api/src/core/sso.ts              |  2 --
 2 files changed, 17 deletions(-)

diff --git a/apps/daas/src/views/login/SsoCallback.vue b/apps/daas/src/views/login/SsoCallback.vue
index 576f969b86..84bdd82d6f 100644
--- a/apps/daas/src/views/login/SsoCallback.vue
+++ b/apps/daas/src/views/login/SsoCallback.vue
@@ -30,7 +30,6 @@ export default {
         return
       }
       try {
-        this.stripAuthParamsFromUrl()
         Cookie.set('access_token', accessToken)
         Cookie.set('tem_token', accessToken)
         // Mark the session so logout can trigger SP-initiated SLO.
@@ -61,20 +60,6 @@ export default {
         this.redirectToLogin(error?.message)
       }
     },
-    stripAuthParamsFromUrl() {
-      const [hashPath, hashQuery] = location.hash.split('?')
-      if (!hashQuery) {
-        return
-      }
-      const params = new URLSearchParams(hashQuery)
-      params.delete('access_token')
-      const nextHash = params.toString() ? `${hashPath}?${params}` : hashPath
-      history.replaceState(
-        null,
-        '',
-        `${location.pathname}${location.search}${nextHash}`,
-      )
-    },
     redirectToLogin(message) {
       Cookie.remove('access_token')
       Cookie.remove('tem_token')
diff --git a/packages/api/src/core/sso.ts b/packages/api/src/core/sso.ts
index 12e09063bf..933d11caed 100644
--- a/packages/api/src/core/sso.ts
+++ b/packages/api/src/core/sso.ts
@@ -34,8 +34,6 @@ export function getSamlLoginUrl() {
  */
 export function getSamlLogoutUrl(accessToken?: string) {
   const relay = `relayState=${encodeURIComponent(SSO_LOGOUT_RELAY_STATE)}`
-  // Browser navigation cannot set Authorization. TM GET /logout still reads
-  // optional access_token to find the SAML session for IdP SLO (COMPAT).
   return accessToken
     ? `${SSO_BASE_URL}/logout?access_token=${encodeURIComponent(accessToken)}&${relay}`
     : `${SSO_BASE_URL}/logout?${relay}`

From 2f688ddfa1e8393990cbd50c8579d633155e8d5f Mon Sep 17 00:00:00 2001
From: hardy <2545433047@qq.com>
Date: Thu, 8 Oct 2026 14:15:14 +0800
Subject: [PATCH 4/4] fix(TAP-11883): keep SAML access_token out of callback
 and logout URLs

- Strip access_token from the SSO callback URL right after reading it,
  before any await, so it never stays in the address bar, history or
  lastLocationHref; share the cleanup with the ?token= entry path.
- Start SAML logout via POST /api/sso/saml/logout with a Bearer header
  and navigate to the returned redirectUrl instead of putting the token
  in the logout URL. Requires the matching TM endpoint.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 apps/daas/src/main.ts                     | 19 ++++-----
 apps/daas/src/utils/util.ts               | 48 ++++++++++++++++++++---
 apps/daas/src/views/login/SsoCallback.vue |  5 ++-
 packages/api/src/core/sso.ts              | 23 +++++++----
 4 files changed, 69 insertions(+), 26 deletions(-)

diff --git a/apps/daas/src/main.ts b/apps/daas/src/main.ts
index 068235e39d..2479080596 100644
--- a/apps/daas/src/main.ts
+++ b/apps/daas/src/main.ts
@@ -18,7 +18,12 @@ import App from '@/App.vue'
 import { installOEM } from '@/oem'
 import { installAllPlugins } from '@/plugins'
 import { initRequestClient } from '@/plugins/axios'
-import { configUser, getUrlSearch, signOut } from '@/utils/util'
+import {
+  configUser,
+  getUrlSearch,
+  removeUrlParams,
+  signOut,
+} from '@/utils/util'
 import store from '@/vuex' // 引入全局数据控制
 import { installDirectives } from './directives'
 import i18n from './i18n'
@@ -71,17 +76,7 @@ const URL_LANG = getUrlSearch('lang')
 
 if (TOKEN) {
   Cookie.set('access_token', TOKEN)
-  const [hashPath, hashQuery] = location.hash.split('?')
-  if (hashQuery) {
-    const params = new URLSearchParams(hashQuery)
-    params.delete('token')
-    const nextHash = params.toString() ? `${hashPath}?${params}` : hashPath
-    history.replaceState(
-      null,
-      '',
-      `${location.pathname}${location.search}${nextHash}`,
-    )
-  }
+  removeUrlParams('token')
 }
 
 const token = Cookie.get('access_token')
diff --git a/apps/daas/src/utils/util.ts b/apps/daas/src/utils/util.ts
index 2c9ba536a9..9d54b15ffd 100644
--- a/apps/daas/src/utils/util.ts
+++ b/apps/daas/src/utils/util.ts
@@ -1,4 +1,4 @@
-import { getSamlLogoutUrl } from '@tap/api/src/core/sso'
+import { startSamlLogout } from '@tap/api/src/core/sso'
 import { getUserInfoByToken } from '@tap/api/src/core/users'
 import Cookie from '@tap/shared/src/cookie'
 import dayjs from 'dayjs'
@@ -160,17 +160,55 @@ export function signOut() {
   Cookie.remove('user_id')
   Cookie.remove('auth_method')
   clearPermissions()
+  const loginHref = `${location.href.split('#')[0]}#/login`
   if (isSamlSession) {
-    // The backend terminates the local session, then redirects to the IdP SLO
-    // endpoint (or straight back to the login page when SLO is not configured).
-    window.location.href = getSamlLogoutUrl(accessToken)
+    // The backend terminates the local session, then returns the IdP SLO
+    // endpoint (or the login page when SLO is not configured) to navigate to.
+    startSamlLogout(accessToken)
+      .then(({ redirectUrl }) => {
+        location.href = redirectUrl || loginHref
+      })
+      .catch(() => {
+        location.href = loginHref
+      })
     return null
   }
   sessionStorage.setItem('lastLocationHref', location.href)
-  location.href = `${location.href.split('#')[0]}#/login`
+  location.href = loginHref
   return null
 }
 
+/**
+ * Drop credential params from the address bar without adding a history entry,
+ * so the token is not kept in history or later copied into lastLocationHref
+ * (TAP-11883).
+ */
+export function removeUrlParams(...names: string[]) {
+  const search = new URLSearchParams(location.search)
+  const [hashPath, hashQuery = ''] = location.hash.split('?')
+  const hashParams = new URLSearchParams(hashQuery)
+  if (!names.some((name) => search.has(name) || hashParams.has(name))) {
+    return
+  }
+  for (const name of names) {
+    search.delete(name)
+    hashParams.delete(name)
+  }
+  const nextSearch = search.toString() ? `?${search}` : ''
+  const nextHash = hashParams.toString()
+    ? `${hashPath}?${hashParams}`
+    : hashPath
+  // vue-router keeps the full route in history.state.current; drop it there too.
+  const state = history.state?.current
+    ? { ...history.state, current: nextHash.slice(1) }
+    : history.state
+  history.replaceState(
+    state,
+    '',
+    `${location.pathname}${nextSearch}${nextHash}`,
+  )
+}
+
 export function getUrlSearch(name: string) {
   // 未传参，返回空
   if (!name) return null
diff --git a/apps/daas/src/views/login/SsoCallback.vue b/apps/daas/src/views/login/SsoCallback.vue
index 84bdd82d6f..d91ef10acd 100644
--- a/apps/daas/src/views/login/SsoCallback.vue
+++ b/apps/daas/src/views/login/SsoCallback.vue
@@ -3,7 +3,7 @@ import { fetchSettings } from '@tap/api/core/settings'
 import { getUserInfoByToken } from '@tap/api/src/core/users'
 import Cookie from '@tap/shared/src/cookie'
 import { setSettings } from '@tap/shared/src/settings'
-import { configUser, getUrlSearch } from '@/utils/util'
+import { configUser, getUrlSearch, removeUrlParams } from '@/utils/util'
 import LoginPage from './LoginPage.vue'
 
 export default {
@@ -25,6 +25,9 @@ export default {
       // to the hash route. Convert that URL token into a cookie and run the same
       // post-login bootstrap as the password path before the router guard runs.
       const accessToken = getUrlSearch('access_token')
+      // Strip the token before any await so it never stays in the address bar
+      // or history, nor ends up in a later location.href (TAP-11883).
+      removeUrlParams('access_token')
       if (!accessToken) {
         this.redirectToLogin()
         return
diff --git a/packages/api/src/core/sso.ts b/packages/api/src/core/sso.ts
index 933d11caed..8db7780d69 100644
--- a/packages/api/src/core/sso.ts
+++ b/packages/api/src/core/sso.ts
@@ -28,15 +28,22 @@ export function getSamlLoginUrl() {
 }
 
 /**
- * Absolute URL for SP-initiated Single Logout. The browser must navigate to it
- * directly; the backend terminates the local session, then redirects to the IdP
- * SLO endpoint (or straight to the login page when SLO is not configured).
+ * Start SP-initiated Single Logout. The token goes in the Authorization header,
+ * never the URL (TAP-11883); the backend terminates the local session and returns
+ * where the browser should navigate next: the IdP SLO endpoint, or the login page
+ * when SLO is not configured.
  */
-export function getSamlLogoutUrl(accessToken?: string) {
-  const relay = `relayState=${encodeURIComponent(SSO_LOGOUT_RELAY_STATE)}`
-  return accessToken
-    ? `${SSO_BASE_URL}/logout?access_token=${encodeURIComponent(accessToken)}&${relay}`
-    : `${SSO_BASE_URL}/logout?${relay}`
+export function startSamlLogout(accessToken?: string) {
+  return requestClient.post<{ redirectUrl: string }>(
+    `${SSO_BASE_URL}/logout`,
+    { relayState: SSO_LOGOUT_RELAY_STATE },
+    {
+      headers: accessToken
+        ? { Authorization: `Bearer ${accessToken}` }
+        : undefined,
+      skipErrorHandler: true,
+    },
+  )
 }
 
 /** IdP fields extracted from an imported IdP SAML metadata document. */