diff --git a/src/main/java/com/senmesh/security/config/WebSecurityConfigurer.java b/src/main/java/com/senmesh/security/config/WebSecurityConfigurer.java
index 18c5e91..a30432b 100644
--- a/src/main/java/com/senmesh/security/config/WebSecurityConfigurer.java
+++ b/src/main/java/com/senmesh/security/config/WebSecurityConfigurer.java
@@ -18,6 +18,7 @@ import org.springframework.security.web.access.intercept.FilterInvocationSecurit
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
 import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
 import org.springframework.stereotype.Component;
 
 import com.senmesh.security.access.intercept.FilterSecurityInterceptor;
@@ -151,7 +152,7 @@ public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {
 
     // 禁用CSRF
 //    http.csrf().disable();
-    http.csrf(c -> c.ignoringAntMatchers("/login"))  // 登录接口免 CSRF
+    http.csrf(c -> c.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).ignoringAntMatchers("/login"))  // 登录接口免 CSRF
     ;
     http.headers().frameOptions().deny();
     http.headers().xssProtection().block(true);