diff --git a/win-framework/win-spring-boot-starter-biz-tenant/src/main/java/com/win/framework/tenant/core/security/TenantSecurityWebFilter.java b/win-framework/win-spring-boot-starter-biz-tenant/src/main/java/com/win/framework/tenant/core/security/TenantSecurityWebFilter.java
index f31135fd..b939bd3b 100644
--- a/win-framework/win-spring-boot-starter-biz-tenant/src/main/java/com/win/framework/tenant/core/security/TenantSecurityWebFilter.java
+++ b/win-framework/win-spring-boot-starter-biz-tenant/src/main/java/com/win/framework/tenant/core/security/TenantSecurityWebFilter.java
@@ -102,7 +102,8 @@ public class TenantSecurityWebFilter extends ApiRequestFilter {
 
     private boolean isIgnoreUrl(HttpServletRequest request) {
         // 快速匹配，保证性能
-        if (CollUtil.contains(tenantProperties.getIgnoreUrls(), request.getRequestURI())) {
+        String uri = request.getRequestURI();
+        if (CollUtil.contains(tenantProperties.getIgnoreUrls(), uri)) {
             return true;
         }
         // 逐个 Ant 路径匹配
diff --git a/win-framework/win-spring-boot-starter-security/src/main/java/com/win/framework/security/config/WinWebSecurityConfigurerAdapter.java b/win-framework/win-spring-boot-starter-security/src/main/java/com/win/framework/security/config/WinWebSecurityConfigurerAdapter.java
index 0b61db62..b2cb477c 100644
--- a/win-framework/win-spring-boot-starter-security/src/main/java/com/win/framework/security/config/WinWebSecurityConfigurerAdapter.java
+++ b/win-framework/win-spring-boot-starter-security/src/main/java/com/win/framework/security/config/WinWebSecurityConfigurerAdapter.java
@@ -128,7 +128,7 @@ public class WinWebSecurityConfigurerAdapter {
                 // 1.4 设置 App API 无需认证
                 .antMatchers(buildAppApi("/**")).permitAll()
                 // 1.5 验证码captcha 允许匿名访问
-                .antMatchers("/captcha/captchaImage").permitAll()
+                //.antMatchers("/captcha/captchaImage").permitAll()
                 // 1.6 webSocket 允许匿名访问
                 .antMatchers("/websocket/message").permitAll()
                 // ②：每个项目的自定义规则