diff --git a/Atomx.Admin/Atomx.Admin.Client/Models/LoginModel.cs b/Atomx.Admin/Atomx.Admin.Client/Models/LoginModel.cs
index 1f51a6d..3fcaab4 100644
--- a/Atomx.Admin/Atomx.Admin.Client/Models/LoginModel.cs
+++ b/Atomx.Admin/Atomx.Admin.Client/Models/LoginModel.cs
@@ -20,6 +20,6 @@
         /// <summary>
         /// 是否记住我
         /// </summary>
-        public bool SaveMe { get; set; }
+        public bool RememberMe { get; set; }
     }
 }
diff --git a/Atomx.Admin/Atomx.Admin.Client/Pages/Login.razor b/Atomx.Admin/Atomx.Admin.Client/Pages/Login.razor
index b1d1611..0bcb0aa 100644
--- a/Atomx.Admin/Atomx.Admin.Client/Pages/Login.razor
+++ b/Atomx.Admin/Atomx.Admin.Client/Pages/Login.razor
@@ -2,7 +2,6 @@
 @layout EmptyLayout
 @inject ILogger<Login> Logger
 
-
 <PageTitle>登录</PageTitle>
 
 @if (!dataLoaded)
@@ -67,7 +66,6 @@ else
 
     private bool _isLoading = false;
 
-
     protected override void OnInitialized()
     {
         if (OperatingSystem.IsBrowser())
@@ -85,12 +83,9 @@ else
         if (firstRender)
         {
             var authState = await AuthStateProvider.GetAuthenticationStateAsync();
-            if (authState.User.Identity != null)
+            if (authState.User.Identity != null && authState.User.Identity.IsAuthenticated)
             {
-                if (authState.User.Identity.IsAuthenticated)
-                {
-                    Navigation.NavigateTo(ReturnUrl ?? "/");
-                }
+                Navigation.NavigateTo(ReturnUrl ?? "/");
             }
         }
         if (!dataLoaded)
@@ -102,32 +97,49 @@ else
 
     private async Task LoginAsync()
     {
-        if (form.Validate())
+        if (!form.Validate()) return;
+
+        _isLoading = true;
+        StateHasChanged();
+
+        try
         {
+            // 请求后端登录接口，后端返回 ApiResult<AuthResponse>
             var api = "/api/sign/in";
-            var result = await HttpService.Post<ApiResult<string>>(api, login);
-            if (result.Success)
+            var result = await HttpService.Post<ApiResult<AuthResponse>>(api, login);
+            if (result.Success && result.Data != null)
             {
-                Console.WriteLine("请求api成功");
-                if (!string.IsNullOrEmpty(result.Data))
+                var auth = result.Data;
+
+                // 保存 access + refresh 到 localStorage（WASM 场景）
+                await localStorage.SetItemAsync("accessToken", auth.Token);
+                await localStorage.SetItemAsync("refreshToken", auth.RefreshToken);
+
+                // 更新客户端 AuthenticationState（调用自定义 Provider 更新方法）
+                if (AuthStateProvider is PersistentAuthenticationStateProvider provider)
                 {
-                    await localStorage.SetItemAsStringAsync(StorageKeys.AccessToken, result.Data);
-                    await localStorage.SetItemAsStringAsync("refreshToken", result.Data);
-                    var authState = (AuthStateProvider as PersistentAuthenticationStateProvider);
-                    if (authState != null)
-                    {
-                        authState.UpdateAuthenticationState(result.Data);
-                    }
-                    Logger.LogInformation($"登录成功跳转目标,{ReturnUrl}");
-                    Navigation.NavigateTo(ReturnUrl ?? "/");
+                    // provider 仅需要 access token 更新来触发 UI 更新
+                    provider.UpdateAuthenticationState(auth.Token);
                 }
+
+                Logger.LogInformation("登录成功，跳转: {ReturnUrl}", ReturnUrl);
+                Navigation.NavigateTo(ReturnUrl ?? "/");
             }
             else
             {
                 ModalService.Error(new ConfirmOptions() { Title = "提示", Content = result.Message });
             }
         }
-
+        catch (Exception ex)
+        {
+            Logger.LogError(ex, "登录失败");
+            ModalService.Error(new ConfirmOptions() { Title = "错误", Content = "登录异常，请稍后重试" });
+        }
+        finally
+        {
+            _isLoading = false;
+            StateHasChanged();
+        }
     }
 
     private async Task OnPasswordKeyDown(KeyboardEventArgs value)
diff --git a/Atomx.Admin/Atomx.Admin.Client/Program.cs b/Atomx.Admin/Atomx.Admin.Client/Program.cs
index 1215574..a399d07 100644
--- a/Atomx.Admin/Atomx.Admin.Client/Program.cs
+++ b/Atomx.Admin/Atomx.Admin.Client/Program.cs
@@ -6,26 +6,26 @@ using Microsoft.AspNetCore.Components.WebAssembly.Hosting;
 
 var builder = WebAssemblyHostBuilder.CreateDefault(args);
 
-// ע�᱾�ش洢��������
+// ע�᱾�ش洢��WASM ʹ�� localStorage ���� tokens��
 builder.Services.AddBlazoredLocalStorageAsSingleton();
 
-// ��Ȩ/�������
+// ��Ȩ/���ݣ�WASM ʹ�������� AuthenticationStateProvider��
 builder.Services.AddAuthorizationCore();
 builder.Services.AddCascadingAuthenticationState();
 builder.Services.AddSingleton<AuthenticationStateProvider, PersistentAuthenticationStateProvider>();
 
-// Ȩ�� & ���ػ�
+// Ȩ�� & ���ػ����ͻ���ʵ�֣�
 builder.Services.AddScoped<IPermissionService, ClientPermissionService>();
 builder.Services.AddScoped<IconsExtension>();
 builder.Services.AddScoped<ILocalizationService, LocalizationClientService>();
 
-// Token provider��WASM��
+// Token provider��WASM��: �� localStorage ��ȡ access token
 builder.Services.AddScoped<ITokenProvider, ClientTokenProvider>();
 
 // ע�������Զ����� token & ˢ�µ� DelegatingHandler
 builder.Services.AddScoped<AuthHeaderHandler>();
 
-// ע��һ������ HttpClient����Ӧ�������� API ����ʹ�ã������� AuthHeaderHandler ����ܵ�
+// ���� HttpClient��Ӧ����ͳһʹ�� ApiClient�������� AuthHeaderHandler ��������ܵ�
 var apiBase = builder.Configuration["WebApi:ServerUrl"] ?? builder.HostEnvironment.BaseAddress;
 builder.Services.AddHttpClient("ApiClient", client =>
 {
@@ -33,8 +33,14 @@ builder.Services.AddHttpClient("ApiClient", client =>
 })
 .AddHttpMessageHandler<AuthHeaderHandler>();
 
-// Ϊ����ע��δ�����ֵ� HttpClient��AuthHeaderHandler �ڲ� CreateClient() ʹ��Ĭ�Ϲ�������
-// Ҳע��Ĭ�� HttpClient �� BaseAddress
+// ע��һ������ AuthHeaderHandler �� HttpClient������ˢ�� token������ѭ�����ã�
+// �� client ������ AuthHeaderHandler ��ʹ�� "RefreshClient"
+builder.Services.AddHttpClient("RefreshClient", client =>
+{
+    client.BaseAddress = new Uri(apiBase);
+});
+
+// Ĭ�� HttpClient������ע�� HttpClient��
 builder.Services.AddScoped(sp => sp.GetRequiredService<IHttpClientFactory>().CreateClient("ApiClient"));
 
 // �� WASM DI ��ע�� HttpService��ʹ������ע��� HttpClient ʵ��
diff --git a/Atomx.Admin/Atomx.Admin.Client/Utils/AuthHeaderHandler.cs b/Atomx.Admin/Atomx.Admin.Client/Utils/AuthHeaderHandler.cs
index 21dbd05..3685a11 100644
--- a/Atomx.Admin/Atomx.Admin.Client/Utils/AuthHeaderHandler.cs
+++ b/Atomx.Admin/Atomx.Admin.Client/Utils/AuthHeaderHandler.cs
@@ -13,6 +13,7 @@ namespace Atomx.Admin.Client.Utils
     /// - 在每次请求时将 access token 附带 Authorization header
     /// - 在 401 或响应头包含 "Token-Expired" 时尝试刷新（调用 /api/sign/refresh）
     /// - 防止并发刷新（SemaphoreSlim）
+    /// - 注意：刷新请求必须使用一个不包含本 handler 的 HttpClient（避免循环）
     /// </summary>
     public class AuthHeaderHandler : DelegatingHandler
     {
@@ -45,6 +46,7 @@ namespace Atomx.Admin.Client.Utils
         {
             try
             {
+                // 从 ITokenProvider 获取当前 access token（WASM: ClientTokenProvider 从 localStorage 读取）
                 var token = await _tokenProvider.GetTokenAsync();
                 if (!string.IsNullOrEmpty(token))
                 {
@@ -57,6 +59,7 @@ namespace Atomx.Admin.Client.Utils
 
                 var response = await base.SendAsync(request, cancellationToken);
 
+                // 当发现未授权或后端标记 token 过期时，尝试刷新
                 if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized ||
                     response.Headers.Contains("Token-Expired"))
                 {
@@ -76,6 +79,7 @@ namespace Atomx.Admin.Client.Utils
                             }
                         }
 
+                        // 刷新失败或无 token，跳转到登录页（强制刷新页面，清除 SPA 状态）
                         _navigationManager.NavigateTo("/account/login", true);
                     }
                     else
@@ -93,6 +97,13 @@ namespace Atomx.Admin.Client.Utils
             }
         }
 
+        /// <summary>
+        /// 尝试刷新 token
+        /// 关键点：
+        /// - 使用命名 HttpClient "RefreshClient"（在 WASM Program 中注册，不包含本 handler），避免递归
+        /// - 并发刷新时只有一个请求会实际触发刷新，其余等待结果
+        /// - 刷新成功后写入 localStorage（accessToken + refreshToken）
+        /// </summary>
         private async Task<bool> TryRefreshTokenAsync(CancellationToken cancellationToken)
         {
             await _refreshLock.WaitAsync(cancellationToken);
@@ -107,11 +118,13 @@ namespace Atomx.Admin.Client.Utils
                     return false;
                 }
 
-                var client = _httpClientFactory.CreateClient();
-                var reqModel = new
+                // 使用不带本 handler 的 HttpClient 发送刷新请求，避免循环
+                var client = _httpClientFactory.CreateClient("RefreshClient");
+
+                var reqModel = new RefreshRequest
                 {
-                    token = currentAccess,
-                    refreshToken = currentRefresh
+                    Token = currentAccess,
+                    RefreshToken = currentRefresh
                 };
                 var reqJson = JsonSerializer.Serialize(reqModel);
                 using var req = new HttpRequestMessage(HttpMethod.Post, "api/sign/refresh")
@@ -125,6 +138,9 @@ namespace Atomx.Admin.Client.Utils
                     if (!resp.IsSuccessStatusCode)
                     {
                         _logger.LogWarning("Refresh request failed with status {Status}", resp.StatusCode);
+                        // 如果刷新失败，移除本地 token（防止无限重试）
+                        await _localStorage.RemoveItemAsync(AccessTokenKey);
+                        await _localStorage.RemoveItemAsync(RefreshTokenKey);
                         return false;
                     }
 
@@ -137,9 +153,12 @@ namespace Atomx.Admin.Client.Utils
                     if (authResp == null || string.IsNullOrEmpty(authResp.Token) || string.IsNullOrEmpty(authResp.RefreshToken))
                     {
                         _logger.LogWarning("Invalid response from refresh endpoint");
+                        await _localStorage.RemoveItemAsync(AccessTokenKey);
+                        await _localStorage.RemoveItemAsync(RefreshTokenKey);
                         return false;
                     }
 
+                    // 保存新的 tokens 到 localStorage
                     await _localStorage.SetItemAsync(AccessTokenKey, authResp.Token, cancellationToken);
                     await _localStorage.SetItemAsync(RefreshTokenKey, authResp.RefreshToken, cancellationToken);
 
@@ -158,10 +177,14 @@ namespace Atomx.Admin.Client.Utils
             }
         }
 
+        /// <summary>
+        /// 复制原始请求并用新的 token 替换 Authorization header
+        /// </summary>
         private static async Task<HttpRequestMessage> CloneHttpRequestMessageAsync(HttpRequestMessage original, string newToken)
         {
             var clone = new HttpRequestMessage(original.Method, original.RequestUri);
 
+            // 复制内容（如果存在）
             if (original.Content != null)
             {
                 var ms = new MemoryStream();
@@ -176,9 +199,11 @@ namespace Atomx.Admin.Client.Utils
                 }
             }
 
+            // 复制 headers
             foreach (var header in original.Headers)
                 clone.Headers.TryAddWithoutValidation(header.Key, header.Value);
 
+            // 覆盖 Authorization
             clone.Headers.Authorization = new AuthenticationHeaderValue("Bearer", newToken);
 
             return clone;
diff --git a/Atomx.Admin/Atomx.Admin/Controllers/SignController.cs b/Atomx.Admin/Atomx.Admin/Controllers/SignController.cs
index 1c87105..6938e99 100644
--- a/Atomx.Admin/Atomx.Admin/Controllers/SignController.cs
+++ b/Atomx.Admin/Atomx.Admin/Controllers/SignController.cs
@@ -1,5 +1,4 @@
-
-using Atomx.Admin.Client.Models;
+using Atomx.Admin.Client.Models;
 using Atomx.Admin.Client.Validators;
 using Atomx.Admin.Services;
 using Atomx.Admin.Utils;
@@ -16,27 +15,42 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Components.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.IdentityModel.Tokens;
-using System.IdentityModel.Tokens.Jwt;
 using System.Security.Claims;
-using System.Text;
-using System.Threading.Tasks;
 
 namespace Atomx.Admin.Controllers
 {
+    /// <summary>
+    /// 登录/刷新/登出控制器（重构）
+    /// 说明：
+    /// - 返回标准的 AuthResponse（access + refresh + expiry），便于 WASM 客户端保存到 localStorage
+    /// - 仍保留 Cookie 登录（SignInAsync）以兼容 Blazor Server 场景
+    /// - 使用注入的 ITokenService 负责 token 的生成、刷新与撤销（数据库保存 refresh token 哈希）
+    /// - 提供 /api/sign/in (POST), /api/sign/refresh (POST), /api/sign/out (POST)
+    /// </summary>
     [Route("api/[controller]")]
     [ApiController]
     public class SignController : ControllerBase
     {
-        readonly ILogger<SignController> _logger;
-        readonly IIdentityService _identityService;
-        readonly IIdCreatorService _idCreator;
-        readonly IMapper _mapper;
-        readonly DataContext _dbContext;
-        readonly JwtSetting _jwtSetting;
-        readonly ICacheService _cacheService;
-        readonly AuthenticationStateProvider _authenticationStateProvider;
+        private readonly ILogger<SignController> _logger;
+        private readonly IIdentityService _identityService;
+        private readonly IIdCreatorService _idCreator;
+        private readonly IMapper _mapper;
+        private readonly DataContext _dbContext;
+        private readonly JwtSetting _jwtSetting;
+        private readonly ICacheService _cacheService;
+        private readonly AuthenticationStateProvider _authenticationStateProvider;
+        private readonly ITokenService _tokenService;
 
-        public SignController(ILogger<SignController> logger, IIdentityService identityService, IIdCreatorService idCreator, IMapper mapper, DataContext dbContext, JwtSetting jwtSetting, ICacheService cacheService, AuthenticationStateProvider authenticationStateProvider)
+        public SignController(
+            ILogger<SignController> logger,
+            IIdentityService identityService,
+            IIdCreatorService idCreator,
+            IMapper mapper,
+            DataContext dbContext,
+            JwtSetting jwtSetting,
+            ICacheService cacheService,
+            AuthenticationStateProvider authenticationStateProvider,
+            ITokenService tokenService)
         {
             _logger = logger;
             _identityService = identityService;
@@ -46,106 +60,201 @@ namespace Atomx.Admin.Controllers
             _jwtSetting = jwtSetting;
             _cacheService = cacheService;
             _authenticationStateProvider = authenticationStateProvider;
+            _tokenService = tokenService;
         }
 
         /// <summary>
-        /// 用户登录系统
+        /// 登录：支持邮箱或用户名登录
+        /// - 返回 AuthResponse 给 WASM（access + refresh）
+        /// - 在 Server 场景同时创建 Cookie（兼容 Blazor Server）
         /// </summary>
-        /// <returns></returns>
         [HttpPost("in")]
         [AllowAnonymous]
-        public async Task<IActionResult> Login(LoginModel model)
+        public async Task<IActionResult> Login([FromBody] LoginModel model)
         {
             var validator = new LoginModelValidator();
             var validation = validator.Validate(model);
-
             if (!validation.IsValid)
             {
-                var message = validation.Errors.FirstOrDefault()?.ErrorMessage;
-                var result = new ApiResult<string>().IsFail(message ?? string.Empty, null);
-                return new JsonResult(result);
+                var message = validation.Errors.FirstOrDefault()?.ErrorMessage ?? string.Empty;
+                return new JsonResult(new ApiResult<AuthResponse>().IsFail(message, null));
             }
 
-            var tokenHandler = new JwtSecurityTokenHandler();
-            var issuer = _jwtSetting.Issuer;
-            var audience = _jwtSetting.Audience;
-            var securityKey = _jwtSetting.SecurityKey;
-
-            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(securityKey));
-            var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
-
-            Common.Entities.Admin? user = null;
+            // 查询用户（支持 email / username）
+            Atomx.Common.Entities.Admin? user = null;
             if (model.Account.Contains("@"))
             {
-                user = _dbContext.Admins.Where(p => p.Email == model.Account).SingleOrDefault();
+                user = _dbContext.Admins.SingleOrDefault(p => p.Email == model.Account);
             }
             else
             {
-                user = _dbContext.Admins.Where(p => p.Username == model.Account).SingleOrDefault();
+                user = _dbContext.Admins.SingleOrDefault(p => p.Username == model.Account);
             }
 
             if (user == null)
             {
-                var result = new ApiResult<string>().IsFail("用户不存在", null);
-                return new JsonResult(result);
+                return new JsonResult(new ApiResult<AuthResponse>().IsFail("用户不存在", null));
             }
+
+            // 简单密码校验（项目 uses MD5 存储示例）
             if (user.Password != model.Password.ToMd5Password())
             {
-                var result = new ApiResult<string>().IsFail("账号密码不正确", null);
-                return new JsonResult(result);
+                return new JsonResult(new ApiResult<AuthResponse>().IsFail("账号密码不正确", null));
             }
 
-            var role = _dbContext.Roles.Where(p => p.Id == user.RoleId).SingleOrDefault();
+            // 生成 access + refresh（TokenService 会把 refresh 的哈希保存到数据库）
+            var ip = _identityService.GetClientIp();
+            var userAgent = Request.Headers["User-Agent"].FirstOrDefault();
+            var authResponse = await _tokenService.GenerateTokenAsync(user, ip, userAgent);
 
-            var claims = new List<Claim>()
-              {
-                    new Claim(ClaimKeys.Id, user.Id.ToString()),
-                    new Claim(ClaimKeys.Email, user.Email),
-                    new Claim(ClaimKeys.Name, user.Username),
-                    new Claim(ClaimKeys.Role, user.RoleId.ToString()),
-                    new Claim(ClaimKeys.Permission, role?.Permission??string.Empty)
-                };
+            // 更新用户登录统计信息
+            user.LastLogin = DateTime.UtcNow;
+            user.LastIp = ip;
+            user.LoginCount++;
+            _dbContext.Admins.Update(user);
+            await _dbContext.SaveChangesAsync();
+
+            // 为 Blazor Server 场景创建 Cookie（Claims 中包含必要角色/权限）
+            var role = _dbContext.Roles.SingleOrDefault(p => p.Id == user.RoleId);
+            var claims = new List<Claim>
+            {
+                new Claim(ClaimKeys.Id, user.Id.ToString()),
+                new Claim(ClaimKeys.Email, user.Email ?? string.Empty),
+                new Claim(ClaimKeys.Name, user.Username ?? string.Empty),
+                new Claim(ClaimKeys.Role, user.RoleId.ToString()),
+                new Claim(ClaimKeys.Permission, role?.Permission ?? string.Empty)
+            };
 
             var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
 
+            // SignInAsync 创建 HttpOnly Cookie，便于 Server-side 认证
+            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
+                new ClaimsPrincipal(claimsIdentity),
+                new AuthenticationProperties
+                {
+                    IsPersistent = model.RememberMe,
+                    AllowRefresh = true,
+                    ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(_jwtSetting.AccessTokenExpirationMinutes)
+                });
 
-            var tokenDescriptor = new SecurityTokenDescriptor
+            // 另外将 tokens 写入 HttpOnly Cookie（增强与传统中间件的兼容性）
+            try
             {
-                Subject = claimsIdentity,
+                var cookieOptions = new CookieOptions
+                {
+                    HttpOnly = true,
+                    //Secure = !Request.IsLocal(), // 本地调试时允许 http
+                    SameSite = SameSiteMode.Lax,
+                    Expires = DateTimeOffset.UtcNow.AddMinutes(_jwtSetting.AccessTokenExpirationMinutes),
+                    Path = "/"
+                };
+                Response.Cookies.Append("access_token", authResponse.Token, cookieOptions);
 
-                Expires = DateTime.UtcNow.AddMinutes(_jwtSetting.AccessTokenExpirationMinutes),
-                SigningCredentials = credentials,
-                Issuer = issuer,
-                Audience = audience
-            };
-
-            var tokenString = tokenHandler.WriteToken(tokenHandler.CreateToken(tokenDescriptor));
-
-            var loginResult = new ApiResult<string>().IsSuccess(tokenString);
-
-            user.LastLogin = DateTime.UtcNow;
-            user.LastIp = _identityService.GetClientIp();
-            user.LoginCount++;
-            _dbContext.Admins.Update(user);
-            _dbContext.SaveChanges();
-
-
-            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity));
-
-            return new JsonResult(loginResult);
+                var refreshCookieOptions = new CookieOptions
+                {
+                    HttpOnly = true,
+                    //Secure = !Request.IsLocal(),
+                    SameSite = SameSiteMode.Lax,
+                    Expires = DateTimeOffset.UtcNow.AddMinutes(_jwtSetting.RefreshTokenExpirationMinutes),
+                    Path = "/"
+                };
+                Response.Cookies.Append("refresh_token", authResponse.RefreshToken, refreshCookieOptions);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "设置 token cookie 失败（非致命）");
+            }
 
+            return new JsonResult(new ApiResult<AuthResponse>().IsSuccess(authResponse));
         }
 
         /// <summary>
-        /// 用户退出系统
+        /// 刷新：客户端传入（可能已过期的）access token 与 refresh token（明文）
+        /// - TokenService.RefreshTokenAsync 会验证并一次性撤销旧的 refresh token，生成新的对
         /// </summary>
-        /// <returns></returns>
-        [HttpGet("out")]
+        [HttpPost("refresh")]
         [AllowAnonymous]
-        public async Task<IActionResult> LogoutAsync()
+        public async Task<IActionResult> Refresh([FromBody] RefreshRequest request)
         {
-            await HttpContext.SignOutAsync();
-            return new JsonResult(new ApiResult<string>());
+            if (request == null || string.IsNullOrWhiteSpace(request.Token) || string.IsNullOrWhiteSpace(request.RefreshToken))
+            {
+                return BadRequest(new ApiResult<AuthResponse>().IsFail("无效的刷新请求", null));
+            }
+
+            try
+            {
+                var ip = _identityService.GetClientIp();
+                var newTokens = await _tokenService.RefreshTokenAsync(request.Token, request.RefreshToken, ip);
+
+                // 更新 cookie（如存在）
+                try
+                {
+                    var cookieOptions = new CookieOptions
+                    {
+                        HttpOnly = true,
+                        //Secure = !Request.IsLocal(),
+                        SameSite = SameSiteMode.Lax,
+                        Expires = DateTimeOffset.UtcNow.AddMinutes(_jwtSetting.AccessTokenExpirationMinutes),
+                        Path = "/"
+                    };
+                    Response.Cookies.Append("access_token", newTokens.Token, cookieOptions);
+
+                    var refreshCookieOptions = new CookieOptions
+                    {
+                        HttpOnly = true,
+                        //Secure = !Request.IsLocal(),
+                        SameSite = SameSiteMode.Lax,
+                        Expires = DateTimeOffset.UtcNow.AddMinutes(_jwtSetting.RefreshTokenExpirationMinutes),
+                        Path = "/"
+                    };
+                    Response.Cookies.Append("refresh_token", newTokens.RefreshToken, refreshCookieOptions);
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogDebug(ex, "刷新 token 时写 cookie 失败（允许）");
+                }
+
+                return new JsonResult(new ApiResult<AuthResponse>().IsSuccess(newTokens));
+            }
+            catch (SecurityTokenException ex)
+            {
+                _logger.LogWarning(ex, "刷新失败：刷新令牌无效或 access token 无效");
+                return Unauthorized(new ApiResult<AuthResponse>().IsFail("刷新令牌无效或已过期", null));
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "刷新令牌时发生内部错误");
+                return StatusCode(500, new ApiResult<AuthResponse>().IsFail("服务器内部错误", null));
+            }
+        }
+
+        /// <summary>
+        /// 登出：可传入 refresh token 以撤销（WASM 前端应同时清除 localStorage）
+        /// - 本接口会 SignOut Cookie（Server 场景）并尝试撤销 refresh token
+        /// </summary>
+        [HttpPost("out")]
+        [AllowAnonymous]
+        public async Task<IActionResult> LogoutAsync([FromBody] RevokeRequest? revokeRequest = null)
+        {
+            if (revokeRequest != null && !string.IsNullOrWhiteSpace(revokeRequest.RefreshToken))
+            {
+                try
+                {
+                    var ip = _identityService.GetClientIp();
+                    await _tokenService.RevokeTokenAsync(revokeRequest.RefreshToken, ip);
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex, "撤销 refresh token 失败（允许）");
+                }
+            }
+
+            // 清理 Cookie
+            await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+            Response.Cookies.Delete("access_token");
+            Response.Cookies.Delete("refresh_token");
+
+            return new JsonResult(new ApiResult<string>().IsSuccess("已退出"));
         }
     }
 }
diff --git a/Atomx.Admin/Atomx.Admin/Extensions/AuthorizationExtension.cs b/Atomx.Admin/Atomx.Admin/Extensions/AuthorizationExtension.cs
index 63df380..27240be 100644
--- a/Atomx.Admin/Atomx.Admin/Extensions/AuthorizationExtension.cs
+++ b/Atomx.Admin/Atomx.Admin/Extensions/AuthorizationExtension.cs
@@ -9,25 +9,24 @@ using System.Text.Json;
 
 namespace Atomx.Admin.Extensions
 {
+    /// <summary>
+    /// AuthorizationExtension 重构说明：
+    /// - 配置 Cookie + JwtBearer 双方案，JwtBearer 的 Events 中添加对 SignalR / WebSocket 的 query string access_token 读取（OnMessageReceived）
+    /// - 保持 OnChallenge 的重定向行为（对于浏览器访问 API 时友好）
+    /// - 将 JwtSetting 注入为 Singleton 供 TokenService 使用
+    /// </summary>
     public static class AuthorizationExtension
     {
-        /// <summary>
-        /// 添加身份验证服务
-        /// </summary>
-        /// <param name="services"></param>
-        /// <param name="Configuration"></param>
-        /// <param name="environment"></param>
-        /// <exception cref="Exception"></exception>
         public static void AddAuthorize(this IServiceCollection services, IConfiguration Configuration, IWebHostEnvironment environment)
         {
             var jwtSetting = Configuration.GetSection("Authentication:JwtBearer").Get<JwtSetting>();
             if (jwtSetting == null)
             {
-                throw new Exception("缺少配置信息");
+                throw new Exception("缺少配置信息 Authentication:JwtBearer");
             }
             services.AddSingleton(jwtSetting);
 
-            // 从配置读取 Cookie 设置（可在 appsettings.json 的 Authentication:Cookie 节点配置）
+            // Cookie 配置读取
             var cookieConf = Configuration.GetSection("Authentication:Cookie");
             var cookieName = cookieConf.GetValue<string>("Name") ?? ".Atomx.Auth";
             var cookiePath = cookieConf.GetValue<string>("Path") ?? "/";
@@ -36,30 +35,26 @@ namespace Atomx.Admin.Extensions
             var securePolicyStr = cookieConf.GetValue<string>("SecurePolicy");
             var expireMinutes = cookieConf.GetValue<int?>("ExpireMinutes") ?? 60;
 
-            // 解析 SameSite（默认：开发环境 Strict，生产环境 None 用于跨站点场景比如前后端分离）
             SameSiteMode sameSiteMode;
             if (string.IsNullOrWhiteSpace(sameSiteStr) || !Enum.TryParse<SameSiteMode>(sameSiteStr, true, out sameSiteMode))
             {
                 sameSiteMode = environment.IsDevelopment() ? SameSiteMode.Strict : SameSiteMode.None;
             }
 
-            // 解析 SecurePolicy（默认：开发 SameAsRequest，生产 Always）
             CookieSecurePolicy securePolicy;
             if (string.IsNullOrWhiteSpace(securePolicyStr) || !Enum.TryParse<CookieSecurePolicy>(securePolicyStr, true, out securePolicy))
             {
                 securePolicy = environment.IsDevelopment() ? CookieSecurePolicy.SameAsRequest : CookieSecurePolicy.Always;
             }
 
-            //认证配置：注册 Cookie（用于 SignIn/SignOut）和 JwtBearer（用于 API 授权）
             services.AddAuthentication(options =>
             {
-                // 默认用于 API 的认证/挑战方案使用 JwtBearer
+                // 默认用于 API 的认证方案为 JwtBearer
                 options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                 options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
             })
             .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>
             {
-                // Cookie 配置，确保 SignInAsync 能找到处理器
                 options.Cookie.Name = cookieName;
                 options.Cookie.Path = cookiePath;
                 if (!string.IsNullOrWhiteSpace(cookieDomain))
@@ -88,25 +83,37 @@ namespace Atomx.Admin.Extensions
                     ValidateAudience = true,
                     ValidateLifetime = true,
                     ValidateIssuerSigningKey = true,
-                    ValidAudience = jwtSetting.Audience,//Audience
+                    ValidAudience = jwtSetting.Audience,
                     ValidIssuer = jwtSetting.Issuer,
-                    ClockSkew = TimeSpan.FromMinutes(Convert.ToDouble(jwtSetting.ClockSkew)), //过期时钟偏差
+                    ClockSkew = TimeSpan.FromMinutes(Convert.ToDouble(jwtSetting.ClockSkew)),
                     IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSetting.SecurityKey))
                 };
+
+                // 允许从 query string 中获取 access_token（用于 SignalR / WebSocket）
                 options.Events = new JwtBearerEvents
                 {
+                    OnMessageReceived = context =>
+                    {
+                        // SignalR 客户端常把 token 放在 query string 参数 access_token
+                        var accessToken = context.Request.Query["access_token"].FirstOrDefault();
+                        var path = context.HttpContext.Request.Path;
+                        if (!string.IsNullOrEmpty(accessToken) && (path.StartsWithSegments("/hubs") || path.StartsWithSegments("/hub")))
+                        {
+                            context.Token = accessToken;
+                        }
+                        return Task.CompletedTask;
+                    },
                     OnChallenge = context =>
                     {
+                        // 浏览器端访问 API 并无 token 时重定向到登录页
                         var absoluteUri = $"{context.Request.Scheme}://{context.Request.Host}{context.Request.Path}{context.Request.QueryString}";
                         context.HandleResponse();
                         context.Response.Redirect($"/account/login?returnUrl={Uri.EscapeDataString(absoluteUri)}");
                         return Task.CompletedTask;
                     },
-
                     OnAuthenticationFailed = context =>
                     {
-                        //Token expired
-                        if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
+                        if (context.Exception?.GetType() == typeof(SecurityTokenExpiredException))
                         {
                             context.Response.Headers.Append("Token-Expired", "true");
                         }
@@ -115,13 +122,13 @@ namespace Atomx.Admin.Extensions
                 };
             });
 
+            // 注册基于权限的策略
             services.AddAuthorization(options =>
             {
-                // 基于权限的策略
                 var allPermissions = Permissions.GetAllPermissions();
                 foreach (var permission in allPermissions)
                 {
-                    options.AddPolicy(permission, policy => { policy.Requirements.Add(new PermissionRequirement(permission)); });
+                    options.AddPolicy(permission, policy => policy.Requirements.Add(new PermissionRequirement(permission)));
                 }
             });
         }
diff --git a/Atomx.Admin/Atomx.Admin/Middlewares/MonitoringMiddleware.cs b/Atomx.Admin/Atomx.Admin/Middlewares/MonitoringMiddleware.cs
index ede3f70..62c6487 100644
--- a/Atomx.Admin/Atomx.Admin/Middlewares/MonitoringMiddleware.cs
+++ b/Atomx.Admin/Atomx.Admin/Middlewares/MonitoringMiddleware.cs
@@ -6,23 +6,30 @@ using System.Text.RegularExpressions;
 
 namespace Atomx.Admin.Middlewares
 {
+    /// <summary>
+    /// 请求监控中间件
+    /// 变更点：
+    /// - 不再在构造函数注入作用域（scoped）服务 IIdentityService，避免在应用启动时从根 provider 解析 scoped 服务导致异常。
+    /// - 在每次请求处理时通过 HttpContext.RequestServices 获取 IIdentityService（请求作用域内解析）。
+    /// </summary>
     public class MonitoringMiddleware
     {
         private readonly RequestDelegate _next;
         private readonly ILogger<MonitoringMiddleware> _logger;
         private readonly MonitoringOptions _options;
-        private readonly IIdentityService _identityService;
 
-        public MonitoringMiddleware(RequestDelegate next, ILogger<MonitoringMiddleware> logger, IOptions<MonitoringOptions> options, IIdentityService identityService)
+        public MonitoringMiddleware(RequestDelegate next, ILogger<MonitoringMiddleware> logger, IOptions<MonitoringOptions> options)
         {
             _next = next;
             _logger = logger;
             _options = options.Value;
-            _identityService = identityService;
         }
 
         public async Task InvokeAsync(HttpContext context)
         {
+            // 在请求作用域内解析 IIdentityService，避免在中间件构造时从根 provider 解析 scoped 服务
+            var identityService = context.RequestServices.GetService<IIdentityService>();
+
             // 检查是否应该跳过监控
             if (ShouldSkipMonitoring(context))
             {
@@ -32,7 +39,7 @@ namespace Atomx.Admin.Middlewares
 
             var logInfo = new
             {
-                UserId = _identityService.GetUserId(),
+                UserId = identityService?.GetUserId(),
                 Path = context.Request.Path,
                 Method = context.Request.Method,
                 StartTime = DateTime.UtcNow,
@@ -50,7 +57,6 @@ namespace Atomx.Admin.Middlewares
             {
                 stopwatch.Stop();
 
-
                 var logData = new
                 {
                     Path = context.Request.Path,
diff --git a/Atomx.Admin/Atomx.Admin/Program.cs b/Atomx.Admin/Atomx.Admin/Program.cs
index a450b58..1ae1bbf 100644
--- a/Atomx.Admin/Atomx.Admin/Program.cs
+++ b/Atomx.Admin/Atomx.Admin/Program.cs
@@ -28,7 +28,7 @@ using System.Text.Unicode;
 
 var builder = WebApplication.CreateBuilder(args);
 
-// Configure Serilog
+// Serilog ���ã�����ԭ����
 Log.Logger = new LoggerConfiguration()
     .ReadFrom.Configuration(builder.Configuration)
     .Enrich.FromLogContext()
@@ -37,7 +37,7 @@ Log.Logger = new LoggerConfiguration()
     .WriteTo.Console(outputTemplate: "[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj}{NewLine}{Exception}")
     .CreateLogger();
 
-// Add services to the container.
+// ��������ע��
 builder.Services.AddRazorComponents()
     .AddInteractiveServerComponents()
     .AddInteractiveWebAssemblyComponents();
@@ -56,101 +56,93 @@ builder.Services.AddBlazoredLocalStorage();
 builder.Services.AddCascadingAuthenticationState();
 builder.Services.AddHttpContextAccessor();
 
-// Ȩ�޷���
+// Ȩ�޷��� & ��Ȩ������
 builder.Services.AddScoped<IPermissionService, PermissionService>();
 builder.Services.AddScoped<IAuthorizationHandler, PermissionAuthorizationHandler>();
 
-// AuthenticationStateProvider��Server ����ʹ�ÿ�������֤��ʵ����ΪĬ��ע��
+// AuthenticationStateProvider��Server ʹ�ÿ�������֤��ʵ��
 builder.Services.AddScoped<AuthenticationStateProvider, PersistingRevalidatingAuthenticationStateProvider>();
-// �����Ҫ�� Server ��ʹ�� PersistentAuthenticationStateProvider �ľ��幦�ܣ����԰����������ע��
 builder.Services.AddScoped<PersistentAuthenticationStateProvider>();
 
+// �������߷���
 builder.Services.AddScoped<IIdCreatorService, IdCreatorService>();
 builder.Services.AddScoped<IIdentityService, IdentityService>();
 builder.Services.AddScoped<ILocalizationService, LocalizationService>();
 builder.Services.AddScoped<LocalizationFile, LocalizationFile>();
 
-// Server ��ͳһ ITokenProvider ��ʵ�֣�WASM ���� Program.cs ��ע�� ClientTokenProvider
+// Token ������ Provider��Server ʹ�� ServerTokenProvider��
 builder.Services.AddScoped<ITokenProvider, ServerTokenProvider>();
+builder.Services.AddScoped<ITokenService, TokenService>(); // ע���� TokenService
 builder.Services.AddScoped<AuthHeaderHandler>();
 
-// ���� SignalR��֧��ͨ�� query string ���� access_token������ websocket/auth��
+// ע���� Token ��������/ˢ��/���� access & refresh token��
+// - TokenService ʵ�� ITokenService�������� DataContext��ICacheService��JwtSetting ��
+// - �� Server ��ע�룬SignController ���������񽫴� DI ��ȡ��ʵ��
+builder.Services.AddScoped<ITokenService, TokenService>();
+
+// SignalR�����÷���� Hub ֧�֣�ע�⣺JWT �� OnMessageReceived ���� AuthorizationExtension �д�����
 builder.Services.AddSignalR();
 
+// HttpClient �����ݷ���
 builder.Services.AddHttpClientApiService(builder.Configuration["WebApi:ServerUrl"] ?? "http://localhost");
 builder.Services.AddDataService();
-builder.Services.AddAuthorize(builder.Configuration, builder.Environment);
+builder.Services.AddAuthorize(builder.Configuration, builder.Environment); // �����������úõ���֤/��Ȩ
 
+// EF Core DbContext
 var connection = builder.Configuration.GetConnectionString("DefaultConnection") ?? throw new InvalidOperationException("Connection string 'DefaultConnection' not found.");
 builder.Services.AddDbContext<DataContext>(options => options.UseNpgsql(connection, p => p.MigrationsHistoryTable("__DbMigrationsHistory")));
 
+// Redis ���棨�Ѵ��ڣ�
+// ... ����ԭ�� Redis ע��
 
 var redisConnection = builder.Configuration.GetConnectionString("cache");
-
 builder.Services.AddStackExchangeRedisCache(options =>
 {
-    #region
     options.Configuration = redisConnection;
     options.InstanceName = builder.Configuration["RedisCache:InstanceName"];
-    #endregion
 });
 
-//// Redis�ֲ�ʽ����
-//builder.Services.AddSingleton<IConnectionMultiplexer>(sp =>
-//    ConnectionMultiplexer.Connect(redisConnection));
-
-// ������Ӧѹ��
-// Ϊ������ BrowserRefresh ע��ű������� HTML ��Ӧ����ѹ�������� Content-Encoding: br ����ע��ʧ�ܣ�
+// ��Ӧѹ����������
 builder.Services.AddResponseCompression(options =>
 {
     options.EnableForHttps = true;
     options.Providers.Add<BrotliCompressionProvider>();
     options.Providers.Add<GzipCompressionProvider>();
-
-    // �ų� text/html��BrowserRefresh ��Ҫ��δѹ���� HTML ��ע��ű�
     options.MimeTypes = ResponseCompressionDefaults.MimeTypes
         .Where(m => !string.Equals(m, "text/html", StringComparison.OrdinalIgnoreCase))
         .ToArray();
 });
 
-
 builder.Services.AddOpenApi();
-
-
 builder.Services.AddAntDesign();
-
 builder.Services.Configure<MonitoringOptions>(builder.Configuration.GetSection("Monitoring"));
 
 var app = builder.Build();
 
 app.AddDataMigrate();
 
-// ����HTTP����ܵ�
+// Forwarded headers�����������
 app.UseForwardedHeaders(new ForwardedHeadersOptions
 {
     ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
 });
 
-// Configure the HTTP request pipeline.
 if (app.Environment.IsDevelopment())
 {
     app.UseWebAssemblyDebugging();
-    app.MapScalarApiReference(); // ӳ�������ο�·��
-    app.MapOpenApi(); // ӳ�� OpenAPI �ĵ�·��
+    app.MapScalarApiReference();
+    app.MapOpenApi();
 }
 else
 {
     app.UseExceptionHandler("/Error", createScopeForErrors: true);
 }
 
-// ��ȫͷ
-//app.UseSecurityHeaders();
-
-// ��Ӧѹ��
 app.UseResponseCompression();
 
 app.UseCors(option =>
 {
+    // ע�⣺���ʹ�� Cookie ������Ҫ AllowCredentials ��ָ��������Դ���˴�Ϊ��ʾ������������Դ������Ӧ������
     option.AllowAnyOrigin();
     option.AllowAnyMethod();
     option.AllowAnyHeader();
@@ -160,63 +152,30 @@ app.UseStaticFiles(new StaticFileOptions
 {
     OnPrepareResponse = ctx =>
     {
-        // ���澲̬�ļ�
-        ctx.Context.Response.Headers.Append(
-            "Cache-Control", $"public, max-age={31536000}");
+        ctx.Context.Response.Headers.Append("Cache-Control", $"public, max-age={31536000}");
     }
 });
 
-// ��������
-//app.UseRateLimiter();
-
+// �м��˳����֤ -> ��Ȩ
 app.UseAuthentication();
 app.UseAuthorization();
 
+// Antiforgery & ������
 app.UseAntiforgery();
 app.MapStaticAssets();
-
 app.UseMiddleware<MonitoringMiddleware>();
 
-
-//// �������˵�
-//app.MapHealthChecks("/health", new HealthCheckOptions
-//{
-//    ResponseWriter = UIResponseWriter.WriteHealthCheckUIResponse,
-//    Predicate = _ => true,
-//    AllowCachingResponses = false
-//});
-
-//app.MapHealthChecks("/health/ready", new HealthCheckOptions
-//{
-//    ResponseWriter = UIResponseWriter.WriteHealthCheckUIResponse,
-//    Predicate = check => check.Tags.Contains("ready")
-//});
-
-//app.MapHealthChecks("/health/live", new HealthCheckOptions
-//{
-//    ResponseWriter = UIResponseWriter.WriteHealthCheckUIResponse,
-//    Predicate = _ => false
-//});
-
-// SignalR�˵�
-//app.MapHub<ChatHub>("/hubs/chat");
-//app.MapHub<NotificationHub>("/hubs/notification");
+// SignalR endpoints������Ŀ���� Hub�����ڴ˴�ӳ�䣩
+// ������� Hub ���� ChatHub��NotificationHub�����ڴ�ȡ��ע�Ͳ�ӳ��
+// app.MapHub<ChatHub>("/hubs/chat");
+// app.MapHub<NotificationHub>("/hubs/notification");
 
 app.MapControllers();
+
+// Blazor ���ã�Server + WASM render modes��
 app.MapRazorComponents<App>()
     .AddInteractiveServerRenderMode()
     .AddInteractiveWebAssemblyRenderMode()
     .AddAdditionalAssemblies(typeof(Atomx.Admin.Client._Imports).Assembly);
 
-
-//// ȷ�����ݿⴴ����Ǩ��
-//await using (var scope = app.Services.CreateAsyncScope())
-//{
-//    var dbContext = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
-//    await dbContext.Database.MigrateAsync();
-
-//    var seeder = scope.ServiceProvider.GetRequiredService<DatabaseSeeder>();
-//    await seeder.SeedAsync();
-//}
-
 app.Run();