diff --git a/src/main/java/cc/ryanc/halo/config/MvcConfig.java b/src/main/java/cc/ryanc/halo/config/MvcConfig.java
index 0a976cc7e..a532cc9f8 100644
--- a/src/main/java/cc/ryanc/halo/config/MvcConfig.java
+++ b/src/main/java/cc/ryanc/halo/config/MvcConfig.java
@@ -106,7 +106,8 @@ public class MvcConfig implements WebMvcConfigurer {
                         "access-control-allow-methods",
                         "access-control-allow-origin",
                         "access-control-max-age",
-                        "X-Frame-Options")
+                        "X-Frame-Options",
+                        "token")
                 .allowCredentials(false).maxAge(3600);
     }