diff --git a/src/main/java/com/budwk/app/sys/controller/SysLoginController.java b/src/main/java/com/budwk/app/sys/controller/SysLoginController.java
index ee0df51..c99fa63 100644
--- a/src/main/java/com/budwk/app/sys/controller/SysLoginController.java
+++ b/src/main/java/com/budwk/app/sys/controller/SysLoginController.java
@@ -178,14 +178,35 @@ public class SysLoginController {
     @ApiOperation("用户cas登录统一入口")
     public String ssoLogin(HttpSession httpSession, HttpServletRequest request, HttpServletResponse response) {
         Assertion assertion = (Assertion) request.getSession().getAttribute(AbstractCasFilter.CONST_CAS_ASSERTION);
+        String tokenName = StpUtil.getTokenName();
+        boolean tokenCookiePresent = request.getCookies() != null && java.util.Arrays.stream(request.getCookies())
+                .anyMatch(cookie -> tokenName.equals(cookie.getName()) && StrUtil.isNotBlank(cookie.getValue()));
+        log.infof("[CAS诊断] 回调进入 uri=%s, ticketPresent=%s, sessionNew=%s, requestedSessionValid=%s, sessionAssertion=%s, requestAssertion=%s, tokenCookiePresent=%s, secure=%s",
+                request.getRequestURI(), StrUtil.isNotBlank(request.getParameter("ticket")), httpSession.isNew(),
+                request.isRequestedSessionIdValid(), assertion != null && assertion.getPrincipal() != null,
+                request.getAttribute(AbstractCasFilter.CONST_CAS_ASSERTION) != null, tokenCookiePresent, request.isSecure());
         if (null == assertion || assertion.getPrincipal() == null) {
+            log.warn("[CAS诊断] Session 中没有有效认证结果，未执行本地登录，即将跳转首页");
             return ">>:/platform/home";
         }
         String loginName = assertion.getPrincipal().getName();
-        sysUserService.checkThirdPlatformLoginName(loginName);
-        Sys_user sysUser = sysUserService.loginByLoginName(loginName);
-
-        return ">>:" + sysUserService.loginPlus(sysUser, LoginType.CAS, request);
+        String stage = "查询本地用户";
+        try {
+            sysUserService.checkThirdPlatformLoginName(loginName);
+            Sys_user sysUser = sysUserService.loginByLoginName(loginName);
+            stage = "建立本地登录态";
+            log.info("[CAS诊断] 本地用户查询成功，开始执行 loginPlus");
+            String redirect = sysUserService.loginPlus(sysUser, LoginType.CAS, request);
+            boolean tokenCookieWritten = response.getHeaders("Set-Cookie").stream()
+                    .anyMatch(header -> header.startsWith(tokenName + "="));
+            log.infof("[CAS诊断] 本地登录完成 loggedIn=%s, tokenCookieWritten=%s, responseCommitted=%s, appDomain=%s, redirectPath=%s",
+                    StpUtil.isLogin(), tokenCookieWritten, response.isCommitted(), Globals.AppDomain,
+                    redirect == null ? null : redirect.split("[?#]", 2)[0]);
+            return ">>:" + redirect;
+        } catch (RuntimeException e) {
+            log.warnf("[CAS诊断] 回调失败 stage=%s, exceptionType=%s", stage, e.getClass().getName());
+            throw e;
+        }
     }
 
     @At(value = "/platform/wxwork/oauth2/callback", top = true)
diff --git a/src/main/java/com/budwk/app/web/commons/proc/WkFailProcessor.java b/src/main/java/com/budwk/app/web/commons/proc/WkFailProcessor.java
index f24558d..054b817 100644
--- a/src/main/java/com/budwk/app/web/commons/proc/WkFailProcessor.java
+++ b/src/main/java/com/budwk/app/web/commons/proc/WkFailProcessor.java
@@ -163,6 +163,15 @@ public class WkFailProcessor extends ViewProcessor {
      */
     private void notLoginRedirect(HttpServletRequest request, HttpServletResponse response) throws Throwable {
         Assertion assertion = (Assertion) request.getSession().getAttribute(AbstractCasFilter.CONST_CAS_ASSERTION);
+        if (Globals.sso) {
+            String tokenName = cn.dev33.satoken.stp.StpUtil.getTokenName();
+            boolean tokenCookiePresent = request.getCookies() != null && java.util.Arrays.stream(request.getCookies())
+                    .anyMatch(cookie -> tokenName.equals(cookie.getName()) && StrUtil.isNotBlank(cookie.getValue()));
+            log.infof("[CAS诊断] 未登录跳转 uri=%s, sessionAssertion=%s, requestedSessionValid=%s, tokenCookiePresent=%s, tokenHeaderPresent=%s, tokenParameterPresent=%s, secure=%s, appDomain=%s",
+                    request.getRequestURI(), assertion != null && assertion.getPrincipal() != null,
+                    request.isRequestedSessionIdValid(), tokenCookiePresent, StrUtil.isNotBlank(request.getHeader(tokenName)),
+                    StrUtil.isNotBlank(request.getParameter(tokenName)), request.isSecure(), Globals.AppDomain);
+        }
         if (assertion != null && assertion.getPrincipal() != null) {
 //            //判断cas里面是否有用户名 那么造成的原因就是系统中没他的信息
 //            //就是cas已经认证了 但是本地系统没有认证