diff --git a/zdxt-web-client/zdxt-admin-plus-ui/src/layout/components/IframeToggle/index.vue b/zdxt-web-client/zdxt-admin-plus-ui/src/layout/components/IframeToggle/index.vue
index 62a834bb..a2b985b0 100644
--- a/zdxt-web-client/zdxt-admin-plus-ui/src/layout/components/IframeToggle/index.vue
+++ b/zdxt-web-client/zdxt-admin-plus-ui/src/layout/components/IframeToggle/index.vue
@@ -12,17 +12,20 @@
 import InnerLink from '../InnerLink/index.vue';
 
 import { useTagsViewStore } from '@/store/modules/tagsView';
+import { resolveSameOriginUrl } from '@/utils/validate';
 
 const route = useRoute();
 const tagsViewStore = useTagsViewStore();
 
 function iframeUrl(url: string | undefined, query: any) {
+  // 菜单 iframe 链接跟当前访问端口走，避免写死 80 导致 12004 被 X-Frame-Options 拦截
+  const base = resolveSameOriginUrl(url);
   if (Object.keys(query).length > 0) {
     const params = Object.keys(query)
       .map((key) => key + '=' + query[key])
       .join('&');
-    return url + '?' + params;
+    return base + '?' + params;
   }
-  return url;
+  return base;
 }
 </script>
diff --git a/zdxt-web-client/zdxt-admin-plus-ui/src/layout/components/Sidebar/Link.vue b/zdxt-web-client/zdxt-admin-plus-ui/src/layout/components/Sidebar/Link.vue
index fd75f357..185abadc 100644
--- a/zdxt-web-client/zdxt-admin-plus-ui/src/layout/components/Sidebar/Link.vue
+++ b/zdxt-web-client/zdxt-admin-plus-ui/src/layout/components/Sidebar/Link.vue
@@ -5,7 +5,7 @@
 </template>
 
 <script setup lang="ts">
-import { isExternal } from '@/utils/validate';
+import { isExternal, resolveSameOriginUrl } from '@/utils/validate';
 
 const props = defineProps({
   to: {
@@ -28,7 +28,8 @@ const type = computed(() => {
 function linkProps() {
   if (isExt.value) {
     return {
-      href: props.to,
+      // 同主机外链改写为当前 origin，避免端口写死
+      href: resolveSameOriginUrl(props.to as string),
       target: '_blank',
       rel: 'noopener'
     };
diff --git a/zdxt-web-client/zdxt-admin-plus-ui/src/store/modules/permission.ts b/zdxt-web-client/zdxt-admin-plus-ui/src/store/modules/permission.ts
index 621122ab..ae0f329f 100644
--- a/zdxt-web-client/zdxt-admin-plus-ui/src/store/modules/permission.ts
+++ b/zdxt-web-client/zdxt-admin-plus-ui/src/store/modules/permission.ts
@@ -9,7 +9,7 @@ import ParentView from '@/components/ParentView/index.vue';
 import InnerLink from '@/layout/components/InnerLink/index.vue';
 import { ref, computed } from 'vue';
 import { createCustomNameComponent } from '@/utils/createCustomNameComponent';
-import { isHttp } from '@/utils/validate';
+import { isHttp, resolveSameOriginUrl } from '@/utils/validate';
 import { useUserStore } from '@/store/modules/user';
 
 // 匹配views里面所有的.vue文件
@@ -41,11 +41,8 @@ export const usePermissionStore = defineStore('permission', () => {
    */
   const buildIframeUrl = (baseUrl: string): string => {
     if (!baseUrl) return '';
-    // 当配置了 Same-origin 占位符时，替换为浏览器当前的 origin（协议+主机+端口）
-    let resolvedUrl = baseUrl;
-    if (baseUrl.includes('Same-origin')) {
-      resolvedUrl = baseUrl.replace('Same-origin', window.location.origin);
-    }
+    // 同主机绝对地址 / Same-origin 占位符统一跟当前访问端口走
+    const resolvedUrl = resolveSameOriginUrl(baseUrl);
     const userStore = useUserStore();
     const params = new URLSearchParams();
     if (userStore.v1SystemCredential) {
diff --git a/zdxt-web-client/zdxt-admin-plus-ui/src/utils/validate.ts b/zdxt-web-client/zdxt-admin-plus-ui/src/utils/validate.ts
index e2886e45..e2ca39ce 100644
--- a/zdxt-web-client/zdxt-admin-plus-ui/src/utils/validate.ts
+++ b/zdxt-web-client/zdxt-admin-plus-ui/src/utils/validate.ts
@@ -32,6 +32,32 @@ export const isExternal = (path: string) => {
   return /^(https?:|mailto:|tel:)/.test(path);
 };
 
+/**
+ * 将同主机绝对地址改写为当前页面 origin（协议+主机+端口），保证 80/12004 等入口端口一致。
+ * - Same-origin 占位符 → window.location.origin
+ * - 同 hostname 的 http(s) 地址 → 换成当前 origin，路径查询不变
+ * - 相对路径 / 其它域名 → 原样返回
+ */
+export const resolveSameOriginUrl = (url?: string): string => {
+  if (!url) return '';
+  let resolved = url;
+  if (resolved.includes('Same-origin')) {
+    resolved = resolved.replace(/Same-origin/g, window.location.origin);
+  }
+  if (!/^https?:\/\//i.test(resolved)) {
+    return resolved;
+  }
+  try {
+    const parsed = new URL(resolved);
+    if (parsed.hostname === window.location.hostname) {
+      return window.location.origin + parsed.pathname + parsed.search + parsed.hash;
+    }
+  } catch {
+    return resolved;
+  }
+  return resolved;
+};
+
 /**
  * @param {string} str
  * @returns {Boolean}