diff --git a/ruoyi-ui/src/utils/request.js b/ruoyi-ui/src/utils/request.js
index 7150ecb12f0e5f247ae15b90e2993fdb5557b065..847f639866bd11efb64e13f3c20a12908f62e7bf 100644
--- a/ruoyi-ui/src/utils/request.js
+++ b/ruoyi-ui/src/utils/request.js
@@ -1,152 +1,116 @@
 import axios from 'axios'
-import { Notification, MessageBox, Message, Loading } from 'element-ui'
+import { Message, MessageBox, Loading } from 'element-ui'
 import store from '@/store'
 import { getToken } from '@/utils/auth'
 import errorCode from '@/utils/errorCode'
-import { tansParams, blobValidate } from "@/utils/ruoyi"
+import { tansParams, blobValidate } from '@/utils/ruoyi'
 import cache from '@/plugins/cache'
 import { saveAs } from 'file-saver'
 
-let downloadLoadingInstance
-// 是否显示重新登录
-export let isRelogin = { show: false }
+export let isRelogin = { show: false } // 登录失效标记
 
-axios.defaults.headers['Content-Type'] = 'application/json;charset=utf-8'
-// 创建axios实例
 const service = axios.create({
-  // axios中请求配置有baseURL选项，表示请求URL公共部分
   baseURL: process.env.VUE_APP_BASE_API,
-  // 超时
-  timeout: 10000
+  timeout: 10000,
+  headers: { 'Content-Type': 'application/json;charset=utf-8' }
 })
 
-// request拦截器
+/* ===== 请求拦截 ===== */
 service.interceptors.request.use(config => {
-  // 是否需要设置 token
-  const isToken = (config.headers || {}).isToken === false
-  // 是否需要防止数据重复提交
-  const isRepeatSubmit = (config.headers || {}).repeatSubmit === false
-  if (getToken() && !isToken) {
-    config.headers['Authorization'] = 'Bearer ' + getToken() // 让每个请求携带自定义token 请根据实际情况自行修改
-  }
-  // get请求映射params参数
-  if (config.method === 'get' && config.params) {
-    let url = config.url + '?' + tansParams(config.params)
-    url = url.slice(0, -1)
+  const { headers, method, data, url } = config
+  const isToken = headers.isToken === false
+  const isRepeat = headers.repeatSubmit === false
+
+  // Token
+  if (getToken() && !isToken) headers.Authorization = 'Bearer ' + getToken()
+
+  // GET 参数拼接到 URL
+  if (method === 'get' && config.params) {
+    config.url = `${url}?${tansParams(config.params).slice(0, -1)}`
     config.params = {}
-    config.url = url
   }
-  if (!isRepeatSubmit && (config.method === 'post' || config.method === 'put')) {
-    const requestObj = {
-      url: config.url,
-      data: typeof config.data === 'object' ? JSON.stringify(config.data) : config.data,
-      time: new Date().getTime()
-    }
-    const requestSize = Object.keys(JSON.stringify(requestObj)).length // 请求数据大小
-    const limitSize = 5 * 1024 * 1024 // 限制存放数据5M
-    if (requestSize >= limitSize) {
-      console.warn(`[${config.url}]: ` + '请求数据大小超出允许的5M限制，无法进行防重复提交验证。')
-      return config
-    }
+
+  // 防重复提交（仅 POST/PUT）
+  if (!isRepeat && ['post', 'put'].includes(method)) {
+    const requestObj = { url, data: JSON.stringify(data), time: Date.now() }
+    const size = new Blob([JSON.stringify(requestObj)]).size
+    if (size >= 5 * 1024 * 1024) return config // 超 5M 跳过
+
     const sessionObj = cache.session.getJSON('sessionObj')
-    if (sessionObj === undefined || sessionObj === null || sessionObj === '') {
-      cache.session.setJSON('sessionObj', requestObj)
-    } else {
-      const s_url = sessionObj.url                  // 请求地址
-      const s_data = sessionObj.data                // 请求数据
-      const s_time = sessionObj.time                // 请求时间
-      const interval = 1000                         // 间隔时间(ms)，小于此时间视为重复提交
-      if (s_data === requestObj.data && requestObj.time - s_time < interval && s_url === requestObj.url) {
-        const message = '数据正在处理，请勿重复提交'
-        console.warn(`[${s_url}]: ` + message)
-        return Promise.reject(new Error(message))
-      } else {
-        cache.session.setJSON('sessionObj', requestObj)
-      }
+    if (sessionObj &&
+        sessionObj.data === requestObj.data &&
+        sessionObj.url === requestObj.url &&
+        Date.now() - sessionObj.time < 1000) {
+      Message.warning('数据正在处理，请勿重复提交')
+      return Promise.reject(new Error('repeat'))
     }
+    cache.session.setJSON('sessionObj', requestObj)
   }
   return config
-}, error => {
-    console.log(error)
-    Promise.reject(error)
-})
+}, err => Promise.reject(err))
+
+/* ===== 响应拦截 ===== */
+service.interceptors.response.use(
+  res => {
+    if (res.request.responseType === 'blob' || res.request.responseType === 'arraybuffer') return res.data
+
+    const { code, msg } = res.data
+    const message = errorCode[code] || msg || errorCode.default
 
-// 响应拦截器
-service.interceptors.response.use(res => {
-    // 未设置状态码则默认成功状态
-    const code = res.data.code || 200
-    // 获取错误信息
-    const msg = errorCode[code] || res.data.msg || errorCode['default']
-    // 二进制数据则直接返回
-    if (res.request.responseType ===  'blob' || res.request.responseType ===  'arraybuffer') {
-      return res.data
-    }
     if (code === 401) {
-      if (!isRelogin.show) {
-        isRelogin.show = true
-        MessageBox.confirm('登录状态已过期，您可以继续留在该页面，或者重新登录', '系统提示', { confirmButtonText: '重新登录', cancelButtonText: '取消', type: 'warning' }).then(() => {
+      if (isRelogin.show) return Promise.reject('invalid token')
+      isRelogin.show = true
+      MessageBox.confirm('登录已过期，是否重新登录？', '提示', { type: 'warning' })
+        .then(() => {
           isRelogin.show = false
-          store.dispatch('LogOut').then(() => {
-            location.href = '/index'
-          })
-      }).catch(() => {
-        isRelogin.show = false
-      })
+          store.dispatch('LogOut').then(() => (location.href = '/index'))
+        })
+        .catch(() => (isRelogin.show = false))
+      return Promise.reject('invalid token')
     }
-      return Promise.reject('无效的会话，或者会话已过期，请重新登录。')
-    } else if (code === 500) {
-      Message({ message: msg, type: 'error' })
-      return Promise.reject(new Error(msg))
-    } else if (code === 601) {
-      Message({ message: msg, type: 'warning' })
-      return Promise.reject('error')
-    } else if (code !== 200) {
-      Notification.error({ title: msg })
-      return Promise.reject('error')
-    } else {
-      return res.data
+    if ([500, 601].includes(code) || code !== 200) {
+      code === 500 ? Message.error(message) : Message.warning(message)
+      return Promise.reject(new Error(message))
     }
+    return res.data
   },
-  error => {
-    console.log('err' + error)
-    let { message } = error
-    if (message == "Network Error") {
-      message = "后端接口连接异常"
-    } else if (message.includes("timeout")) {
-      message = "系统接口请求超时"
-    } else if (message.includes("Request failed with status code")) {
-      message = "系统接口" + message.substr(message.length - 3) + "异常"
-    }
-    Message({ message: message, type: 'error', duration: 5 * 1000 })
-    return Promise.reject(error)
+  err => {
+    let msg = '系统错误'
+    if (err.message.includes('timeout')) msg = '请求超时'
+    else if (err.message.includes('Network')) msg = '网络异常'
+    else if (err.message.includes('status code')) msg = `接口异常 ${err.response.status}`
+    Message.error(msg)
+    return Promise.reject(err)
   }
 )
 
-// 通用下载方法
-export function download(url, params, filename, config) {
-  downloadLoadingInstance = Loading.service({ text: "正在下载数据，请稍候", spinner: "el-icon-loading", background: "rgba(0, 0, 0, 0.7)", })
-  return service.post(url, params, {
-    transformRequest: [(params) => { return tansParams(params) }],
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    responseType: 'blob',
-    ...config
-  }).then(async (data) => {
-    const isBlob = blobValidate(data)
-    if (isBlob) {
-      const blob = new Blob([data])
-      saveAs(blob, filename)
-    } else {
-      const resText = await data.text()
-      const rspObj = JSON.parse(resText)
-      const errMsg = errorCode[rspObj.code] || rspObj.msg || errorCode['default']
-      Message.error(errMsg)
-    }
-    downloadLoadingInstance.close()
-  }).catch((r) => {
-    console.error(r)
-    Message.error('下载文件出现错误，请联系管理员！')
-    downloadLoadingInstance.close()
+/* ===== 通用下载 ===== */
+let downloadLoadingInstance
+export function download(url, params, filename, config = {}) {
+  downloadLoadingInstance = Loading.service({
+    text: '正在下载数据，请稍候',
+    spinner: 'el-icon-loading',
+    background: 'rgba(0,0,0,.7)'
   })
+
+  return service
+    .post(url, params, {
+      transformRequest: [() => tansParams(params)],
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      responseType: 'blob',
+      ...config
+    })
+    .then(async data => {
+      if (blobValidate(data)) {
+        saveAs(new Blob([data]), filename)
+      } else {
+        const txt = await data.text()
+        const obj = JSON.parse(txt)
+        Message.error(errorCode[obj.code] || obj.msg || '下载失败')
+      }
+    })
+    .catch(() => Message.error('下载出错，请联系管理员'))
+    .finally(() => downloadLoadingInstance.close())
 }
 
-export default service
+export default service
\ No newline at end of file
diff --git a/ruoyi-ui/src/utils/validate.js b/ruoyi-ui/src/utils/validate.js
index 13b7a15c5431a83516acb39d6f924e3e80a87de2..0644f3b5a1861e342afee1e9b89e9b87feab3531 100644
--- a/ruoyi-ui/src/utils/validate.js
+++ b/ruoyi-ui/src/utils/validate.js
@@ -53,11 +53,14 @@ export function validUsername(str) {
  * @param {string} url
  * @returns {Boolean}
  */
-export function validURL(url) {
-  const reg = /^(https?|ftp):\/\/([a-zA-Z0-9.-]+(:[a-zA-Z0-9.&%$-]+)*@)*((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+\.(com|edu|gov|int|mil|net|org|biz|arpa|info|name|pro|aero|coop|museum|[a-zA-Z]{2}))(:[0-9]+)*(\/($|[a-zA-Z0-9.,?'\\+&%$#=~_-]+))*$/
-  return reg.test(url)
-}
-
+export const validURL = (str) => {
+  try {
+    const u = new URL(str);
+    return /^(https?|ftp):/.test(u.protocol); // 只允许 http/https/ftp
+  } catch {
+    return false;
+  }
+};
 /**
  * @param {string} str
  * @returns {Boolean}
@@ -90,8 +93,9 @@ export function validAlphabets(str) {
  * @returns {Boolean}
  */
 export function validEmail(email) {
-  const reg = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/
-  return reg.test(email)
+  if (typeof email !== 'string' || email.length > 320) return false;
+  // 官方简化版，支持引号、域名字面量、IPv4
+  return /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(email);
 }
 
 /**