diff --git a/login-oauth2-client/src/main/java/ink/wgink/login/oauth2/client/config/OAuth2ClientConfig.java b/login-oauth2-client/src/main/java/ink/wgink/login/oauth2/client/config/OAuth2ClientConfig.java
index e3e3d9d2..7d7f7ae0 100755
--- a/login-oauth2-client/src/main/java/ink/wgink/login/oauth2/client/config/OAuth2ClientConfig.java
+++ b/login-oauth2-client/src/main/java/ink/wgink/login/oauth2/client/config/OAuth2ClientConfig.java
@@ -4,8 +4,6 @@ package ink.wgink.login.oauth2.client.config;
 import ink.wgink.login.oauth2.client.converter.OAuth2ClientUserAccessTokenConverter;
 import ink.wgink.properties.BaseProperties;
 import ink.wgink.properties.oauth2.client.OAuth2ClientProperties;
-import org.apache.commons.lang3.ArrayUtils;
-import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.security.oauth2.client.EnableOAuth2Sso;
 import org.springframework.context.annotation.Bean;
@@ -46,25 +44,16 @@ public class OAuth2ClientConfig extends WebSecurityConfigurerAdapter {
                 "/wechat-miniapp/**",
                 "/route/file/**",
         };
-        String assetsMatchers = baseProperties.getAssetsMatchers();
-        String[] fullAntMatchers;
-        if (!StringUtils.isBlank(assetsMatchers)) {
-            String[] assetsMatchersArray = baseProperties.getAssetsMatchers().split(",");
-            fullAntMatchers = ArrayUtils.addAll(defaultAntMatchers, assetsMatchersArray);
-        } else {
-            fullAntMatchers = defaultAntMatchers;
-        }
-        http
-                .formLogin()
+        http.formLogin()
                 .defaultSuccessUrl("/authorize", true)
                 .and()
                 .logout().logoutSuccessUrl(oAuth2ClientProperties.getOauthLogout())
                 .and()
-                .authorizeRequests().antMatchers(fullAntMatchers).permitAll()
+                .authorizeRequests().antMatchers(defaultAntMatchers).permitAll()
                 .and()
                 .authorizeRequests()
                 .anyRequest()
-                .access("@rbacService.hasPermission(request, authentication)")
+                .access("@accessWhiteList.hasPermission(request, authentication)")
                 .and()
                 .headers().frameOptions().sameOrigin()
                 .and()