fix: harden runtime deployment defaults

backend/app/core/auth.py

@@ -64,11 +64,11 @@ async def exchange_code_for_user(code: str) -> Optional[dict]:
         "code": code,
     }
 
-    async with httpx.AsyncClient(timeout=15, verify=False) as client:
+    async with httpx.AsyncClient(timeout=15) as client:
         try:
             resp = await client.post(token_url, data=data)
             if resp.status_code != 200:
-                logger.error(f"Casdoor token 换取失败: {resp.status_code} {resp.text}")
+                logger.error("Casdoor token 换取失败: status=%s", resp.status_code)
                 return None
 
             token_data = resp.json()
@@ -77,19 +77,16 @@ async def exchange_code_for_user(code: str) -> Optional[dict]:
                 logger.error("Casdoor 返回中没有 id_token")
                 return None
 
-            # 解码 id_token (JWT) payload，不验证签名（HTTPS 已保证传输安全）
-            # 生产环境建议验证 Casdoor 证书
             cert = _load_casdoor_certificate()
-            try:
-                payload = jwt.decode(
-                    id_token,
-                    key=cert or None,
-                    options={"verify_signature": bool(cert)},
-                    audience=settings.CASDOOR_CLIENT_ID,
-                )
-            except JWTError:
-                # 不验证签名的方式解码
-                payload = jwt.get_unverified_claims(id_token)
+            if not cert:
+                logger.error("Casdoor token 验证证书未配置")
+                return None
+
+            payload = jwt.decode(
+                id_token,
+                key=cert,
+                audience=settings.CASDOOR_CLIENT_ID,
+            )
 
             return payload