diff --git a/src/pages/auth/loading.vue b/src/pages/auth/loading.vue
index d7d52ed..34cbb73 100644
--- a/src/pages/auth/loading.vue
+++ b/src/pages/auth/loading.vue
@@ -105,7 +105,13 @@ export default {
           let authUrl = data.data.auth_url;
           if (this.deviceId) {
             const stateVal = encodeURIComponent(JSON.stringify({ device_id: this.deviceId }));
-            authUrl += (authUrl.includes('?') ? '&' : '?') + 'state=' + stateVal;
+            try {
+              const urlObj = new URL(authUrl);
+              urlObj.searchParams.set('state', stateVal);
+              authUrl = urlObj.toString();
+            } catch (_) {
+              authUrl += (authUrl.includes('?') ? '&' : '?') + 'state=' + stateVal;
+            }
           }
           // 跳转微信授权页（静默，不弹窗）
           window.location.href = authUrl;
@@ -233,8 +239,15 @@ export default {
           if (this.deviceId) {
             stateObj.device_id = this.deviceId;
           }
+          const stateVal = encodeURIComponent(JSON.stringify(stateObj));
           let authUrl = data.data.auth_url;
-          authUrl += (authUrl.includes('?') ? '&' : '?') + 'state=' + encodeURIComponent(JSON.stringify(stateObj));
+          try {
+            const urlObj = new URL(authUrl);
+            urlObj.searchParams.set('state', stateVal);
+            authUrl = urlObj.toString();
+          } catch (_) {
+            authUrl += (authUrl.includes('?') ? '&' : '?') + 'state=' + stateVal;
+          }
           // 跳转微信授权页（弹窗确认）
           window.location.href = authUrl;
         } else {
@@ -269,14 +282,16 @@ export default {
         url.searchParams.delete('action');
         window.history.replaceState({}, '', url.toString());
 
-        // 用 code 调用 /api/v1/user/info 获取用户信息
-        const res = await gatewayGet('/api/v1/user/info', {
+        // 用 code 调用 POST /api/v1/user/info 获取用户信息（必须用 POST，GET 是另一个端点）
+        console.log('[loading] 请求 POST user/info, app_no:', appNo, 'code:', code);
+        const res = await gatewayPost('/api/v1/user/info', {
           app_no: appNo,
           code: code,
         });
 
         const data = res.data || {};
-        console.log('[loading] user info response:', JSON.stringify(data, null, 2));
+        console.log('[loading] user/info response:', JSON.stringify(data, null, 2));
+        console.log('[loading] user/info statusCode:', res.statusCode);
 
         if (data.code === 0 && data.data) {
           const userInfo = data.data;
diff --git a/src/pages/index/index.vue b/src/pages/index/index.vue
index 9457f2a..10fa4b1 100644
--- a/src/pages/index/index.vue
+++ b/src/pages/index/index.vue
@@ -344,8 +344,18 @@ export default {
           if (this.deviceId) {
             stateObj.device_id = this.deviceId;
           }
+          const stateVal = encodeURIComponent(JSON.stringify(stateObj));
+          // 解析 auth_url，安全地设置 state 参数（避免重复）
           let authUrl = data.data.auth_url;
-          authUrl += (authUrl.includes('?') ? '&' : '?') + 'state=' + encodeURIComponent(JSON.stringify(stateObj));
+          try {
+            const urlObj = new URL(authUrl);
+            urlObj.searchParams.set('state', stateVal);
+            authUrl = urlObj.toString();
+          } catch (_) {
+            // URL 解析失败时直接拼接
+            authUrl += (authUrl.includes('?') ? '&' : '?') + 'state=' + stateVal;
+          }
+          console.log('[index] 跳转授权页:', authUrl);
           // 跳转微信授权页（弹窗确认）
           window.location.href = authUrl;
         } else {