diff --git a/frontend/.env.development b/frontend/.env.development
index a3457b5..3fd5c3b 100644
--- a/frontend/.env.development
+++ b/frontend/.env.development
@@ -1,3 +1,3 @@
 # 开发环境
 VITE_API_BASE_URL=/api
-VITE_AI_POST_MESSAGE_URL=://localhost:3001/
+VITE_AI_POST_MESSAGE_URL=http://localhost:3001
diff --git a/frontend/.env.production b/frontend/.env.production
index deef555..f32edc7 100644
--- a/frontend/.env.production
+++ b/frontend/.env.production
@@ -2,5 +2,5 @@
 VITE_API_BASE_URL=/api
 # 如果后端部署在不同域名，可以改成完整地址：
 # VITE_API_BASE_URL=https://api.your-domain.com
-VITE_AI_POST_MESSAGE_URL=://localhost:3001
+VITE_AI_POST_MESSAGE_URL=http://localhost:3001
 
diff --git a/frontend/src/views/public/create/Index.vue b/frontend/src/views/public/create/Index.vue
index ca84041..502eb6a 100644
--- a/frontend/src/views/public/create/Index.vue
+++ b/frontend/src/views/public/create/Index.vue
@@ -10,14 +10,8 @@
       </a-button>
     </div>
     <!-- iframe 嵌入乐读派 H5 -->
-    <iframe
-      v-if="iframeSrc"
-      ref="leaiFrame"
-      :src="iframeSrc"
-      class="creation-iframe"
-      allow="camera;microphone"
-      frameborder="0"
-    />
+    <iframe v-if="iframeSrc" ref="leaiFrame" :src="iframeSrc" class="creation-iframe" allow="camera;microphone"
+      frameborder="0" />
   </div>
 </template>
 
@@ -26,7 +20,7 @@ import { ref, onMounted, onUnmounted } from 'vue'
 import { useRouter } from 'vue-router'
 import { message } from 'ant-design-vue'
 import { leaiApi } from '@/api/public'
-
+const VITE_AI_POST_MESSAGE_URL = import.meta.env.VITE_AI_POST_MESSAGE_URL;
 const router = useRouter()
 const leaiFrame = ref<HTMLIFrameElement | null>(null)
 const iframeSrc = ref<string>('')
@@ -37,10 +31,10 @@ const loadError = ref<string>('')
 const initLeai = async () => {
   loading.value = true
   loadError.value = ''
-
+  console.log('VITE_AI_POST_MESSAGE_URL', VITE_AI_POST_MESSAGE_URL);
   try {
     const data = await leaiApi.getToken()
-    iframeSrc.value = `${data.h5Url}/?token=${encodeURIComponent(data.token)}&orgId=${encodeURIComponent(data.orgId)}&phone=${encodeURIComponent(data.phone)}&embed=1`
+    iframeSrc.value = `${VITE_AI_POST_MESSAGE_URL}?token=${encodeURIComponent(data.token)}&orgId=${encodeURIComponent(data.orgId)}&phone=${encodeURIComponent(data.phone)}&embed=1`
   } catch (err: any) {
     const errMsg = err?.response?.data?.message || err?.message || '加载失败'
     loadError.value = errMsg
@@ -54,6 +48,10 @@ const initLeai = async () => {
 
 /** 监听乐读派 H5 postMessage 事件 */
 const handleMessage = (event: MessageEvent) => {
+  if (event.origin !== VITE_AI_POST_MESSAGE_URL) {
+    console.log('event.origin', event.origin);
+    return
+  }
   const msg = event.data
   // 只处理乐读派 H5 的消息
   if (!msg || msg.source !== 'leai-creation') return
@@ -101,7 +99,7 @@ const handleTokenExpired = async (payload: any) => {
         orgId: data.orgId,
         phone: data.phone,
       },
-    }, '*')
+    }, VITE_AI_POST_MESSAGE_URL)
     console.log('[创作工坊] Token已刷新')
   } catch (err) {
     console.error('[创作工坊] Token刷新失败:', err)
@@ -157,7 +155,9 @@ $primary: #6366f1;
 }
 
 @keyframes spin {
-  to { transform: rotate(360deg); }
+  to {
+    transform: rotate(360deg);
+  }
 }
 
 .loading-text {
diff --git a/lesingle-aicreate-client/.env.development b/lesingle-aicreate-client/.env.development
index 7aa4083..68e48b9 100644
--- a/lesingle-aicreate-client/.env.development
+++ b/lesingle-aicreate-client/.env.development
@@ -1,3 +1,3 @@
 # 开发环境
-VITE_CREATE_POST_MESSAGE_URL=://localhost:3000/
+VITE_CREATE_POST_MESSAGE_URL=http://localhost:3000
 
diff --git a/lesingle-aicreate-client/.env.production b/lesingle-aicreate-client/.env.production
index d0cd207..e5a0901 100644
--- a/lesingle-aicreate-client/.env.production
+++ b/lesingle-aicreate-client/.env.production
@@ -1,2 +1,2 @@
 # 生产环境
-VITE_CREATE_POST_MESSAGE_URL=://localhost:3000/
+VITE_CREATE_POST_MESSAGE_URL=http://localhost:3000
diff --git a/lesingle-aicreate-client/src/utils/bridge.js b/lesingle-aicreate-client/src/utils/bridge.js
index 8ea2644..7eb2bdf 100644
--- a/lesingle-aicreate-client/src/utils/bridge.js
+++ b/lesingle-aicreate-client/src/utils/bridge.js
@@ -1,9 +1,9 @@
 /**
- * iframe postMessage 通信桥
+ * iframe postMessage 通信�?
  * 封装 H5 与企业父页面的双向通信
  */
 import config from './config'
-
+const VITE_CREATE_POST_MESSAGE_URL = import.meta.env.VITE_CREATE_POST_MESSAGE_URL;
 const SOURCE = 'leai-creation'
 const VERSION = 1
 const TIMEOUT = 30000
@@ -17,9 +17,8 @@ const targetOrigin = config.parentOrigins.length > 0 ? config.parentOrigins[0] :
 
 export function send(type, payload = {}) {
   if (!isEmbedded) return
-  window.parent.postMessage({ source: SOURCE, version: VERSION, type, payload }, targetOrigin)
+  window.parent.postMessage({ source: SOURCE, version: VERSION, type, payload }, VITE_CREATE_POST_MESSAGE_URL)
 }
-
 export function request(type, payload = {}) {
   if (!isEmbedded) return Promise.reject(new Error('Not in iframe'))
   const messageId = 'msg_' + Date.now() + '_' + Math.random().toString(36).slice(2, 8)
@@ -38,6 +37,11 @@ export function requestTokenRefresh() {
 }
 
 function onMessage(event) {
+  if (event.origin !== VITE_CREATE_POST_MESSAGE_URL) {
+    console.log('event.origin', event.origin);
+    return
+  }
+  console.log('onMessage',event);
   if (config.parentOrigins.length > 0 && !config.parentOrigins.includes(event.origin)) {
     return
   }