diff --git a/app/controller/admin/Base.php b/app/controller/admin/Base.php
index f56952a..e2ffe37 100644
--- a/app/controller/admin/Base.php
+++ b/app/controller/admin/Base.php
@@ -92,6 +92,7 @@ class Base extends BaseController {
             break;
             case  ReturnCode::INVALID:
                 $httpCode = 404;
+            break;
             //ReturnCode::NO_PERMISSION         => 403,
             default :
                 $httpCode =  400;
diff --git a/app/controller/api/Base.php b/app/controller/api/Base.php
index 07ecfd5..52388b5 100644
--- a/app/controller/api/Base.php
+++ b/app/controller/api/Base.php
@@ -48,6 +48,7 @@ class Base extends BaseController {
                 break;
             case  ReturnCode::INVALID:
                 $httpCode = 404;
+            break;
             //ReturnCode::NO_PERMISSION         => 403,
             default :
                 $httpCode =  400;
diff --git a/app/middleware/AdminResponse.php b/app/middleware/AdminResponse.php
index 6967fbb..c08fea5 100644
--- a/app/middleware/AdminResponse.php
+++ b/app/middleware/AdminResponse.php
@@ -19,7 +19,7 @@ class AdminResponse
         }
         $response->header([
             'Vary'                             => 'Origin',
-            'Access-Control-Allow-Methods'     => 'POST,GET,OPTIONS',
+            'Access-Control-Allow-Methods'     => 'POST,GET',
             'Access-Control-Allow-Headers'     => 'Api-Auth,token,Authorization,Content-Type,X-Requested-With',
             'Access-Control-Allow-Credentials' => 'true',
         ]);
diff --git a/app/middleware/WikiAuth.php b/app/middleware/WikiAuth.php
index 0aa7c15..56e9b47 100644
--- a/app/middleware/WikiAuth.php
+++ b/app/middleware/WikiAuth.php
@@ -41,7 +41,7 @@ class WikiAuth {
                 'code' => ReturnCode::AUTH_ERROR,
                 'msg'  => '缺少ApiAuth',
                 'data' => []
-            ])->header($header);
+            ], 403)->header($header);
         }
     }
 }
diff --git a/config/session.php b/config/session.php
index 7df7119..8623eaa 100644
--- a/config/session.php
+++ b/config/session.php
@@ -16,7 +16,7 @@ return [
     'expire'         => 1440,
     // 前缀
     'prefix'         => '',
-    'secure'         => true,
-    'httponly'       => true,
-    'samesite'       => 'Lax',
+    'cookie_secure'   => true,  // 对应 session.cookie_secure
+    'cookie_httponly' => true, // 对应 session.cookie_httponly
+    'cookie_samesite' => 'Lax', // 对应 session.cookie_samesite
 ];