diff --git a/public/login.html b/public/login.html
index d1da14d..0503890 100644
--- a/public/login.html
+++ b/public/login.html
@@ -147,6 +147,7 @@
       try {
         const res = await fetch('/api/login', {
           method: 'POST',
+          credentials: 'same-origin',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ role: 'admin', password: input.value })
         });
diff --git a/public/viewer.html b/public/viewer.html
index a73d192..4fe9c87 100644
--- a/public/viewer.html
+++ b/public/viewer.html
@@ -315,7 +315,7 @@
 
     async function loadAppConfig() {
       try {
-        const res = await fetch('/api/app-config');
+        const res = await fetch('/api/app-config', { credentials: 'same-origin' });
         if (res.ok) {
           const data = await res.json();
           appConfig.publicBaseUrl = (data.publicBaseUrl || '').replace(/\/+$/, '');
@@ -326,7 +326,7 @@
     }
 
     async function checkSession() {
-      const res = await fetch('/api/session');
+      const res = await fetch('/api/session', { credentials: 'same-origin' });
       if (!res.ok) return false;
       const data = await res.json();
       return data.authenticated && (data.role === 'viewer' || data.role === 'admin');
@@ -344,7 +344,7 @@
     }
 
     async function loadHistory() {
-      const res = await fetch('/api/history');
+      const res = await fetch('/api/history', { credentials: 'same-origin' });
       if (res.status === 401) {
         showLogin('请先输入访问密码。');
         return;
@@ -417,6 +417,7 @@
       try {
         const res = await fetch('/api/login', {
           method: 'POST',
+          credentials: 'same-origin',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ role: 'viewer', password: input.value })
         });
@@ -424,8 +425,7 @@
         if (!res.ok) {
           throw new Error(data.error || '密码不正确');
         }
-        showHistory();
-        await loadHistory();
+        window.location.href = data.redirectTo || '/sub';
       } catch (e) {
         error.textContent = e.message;
       } finally {