diff --git a/admin/src/utils/request.js b/admin/src/utils/request.js
index 3ded21b..0db322f 100644
--- a/admin/src/utils/request.js
+++ b/admin/src/utils/request.js
@@ -52,10 +52,8 @@ service.interceptors.response.use(
       const { status, data } = error.response
       if (status === 401) {
         const isOnLoginPage = router.currentRoute.value.path === '/login'
-        if (isOnLoginPage) {
-          ElMessage.error(data?.message || '账号或密码错误')
-        } else {
-          ElMessage.error('登录已过期，请重新登录')
+        ElMessage.error(data?.message || '登录已过期，请重新登录')
+        if (!isOnLoginPage) {
           localStorage.removeItem('admin_token')
           localStorage.removeItem('admin_user')
           router.push('/login')
diff --git a/backend/go-service/app/auth/service/auth_service.go b/backend/go-service/app/auth/service/auth_service.go
index c199b04..3451bb8 100644
--- a/backend/go-service/app/auth/service/auth_service.go
+++ b/backend/go-service/app/auth/service/auth_service.go
@@ -139,11 +139,11 @@ func (s *AuthService) Login(ctx context.Context, req *dto.LoginRequest, clientIP
 		}
 	}()
 
-	// 按用户名或邮箱查找用户
+	// 按用户名或邮箱查找用户（用户不存在时统一返回密码错误，防止枚举攻击）
 	user, findErr := s.userDAO.FindByAccount(ctx, req.Account)
 	if findErr != nil {
 		if errors.Is(findErr, gorm.ErrRecordNotFound) {
-			err = ErrUserNotFound
+			err = ErrPasswordWrong
 		} else {
 			err = findErr
 		}
diff --git a/frontend/src/utils/request.js b/frontend/src/utils/request.js
index b9f7410..5767deb 100644
--- a/frontend/src/utils/request.js
+++ b/frontend/src/utils/request.js
@@ -73,18 +73,16 @@ const request = (options) => {
             reject(data)
           }
         } else if (statusCode === 401) {
-          // Token 过期或无效，清除本地 Token 并跳转登录页
-          removeToken()
-          uni.showToast({
-            title: '登录已过期，请重新登录',
-            icon: 'none',
-            duration: 2000
-          })
-          // 延迟跳转，让 Toast 有时间显示
-          setTimeout(() => {
-            uni.reLaunch({ url: '/pages/auth/login' })
-          }, 1500)
-          reject({ code: 401, message: '认证已失效' })
+          const isAuthEndpoint = /\/auth\/(login|register)$/.test(options.url)
+          const message = data?.message || '登录已过期，请重新登录'
+          uni.showToast({ title: message, icon: 'none', duration: 2000 })
+          if (!isAuthEndpoint) {
+            removeToken()
+            setTimeout(() => {
+              uni.reLaunch({ url: '/pages/auth/login' })
+            }, 1500)
+          }
+          reject({ code: 401, message })
         } else if (statusCode === 403) {
           uni.showToast({
             title: data.message || '没有访问权限',