diff --git a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/CsrfFilter.java b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/CsrfFilter.java
index ca354e15..4880f886 100644
--- a/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/CsrfFilter.java
+++ b/jero-boot/jero-boot-base/jero-boot-base-core/src/main/java/com/jero/config/CsrfFilter.java
@@ -57,7 +57,7 @@ public class CsrfFilter implements Filter {
             String url = req.getRequestURL().toString();
             // 获取来源
             String referurl = req.getHeader("Referer");
-            if(isWhiteReq(referurl)){
+            if(isWhiteReq(referurl) || url.contains("/websocket/") || url.contains("download")){
                 chain.doFilter(request, response);
             }else{
                 String log = "";
@@ -81,7 +81,7 @@ public class CsrfFilter implements Filter {
      */
     private boolean isWhiteReq(String referUrl) {
         if (referUrl == null || "".equals(referUrl) || size == 0) {
-            return true;
+            return false;
         } else {
             String refHost = "";
             referUrl = referUrl.toLowerCase();
diff --git a/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml b/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml
index cb7df984..3225c31d 100644
--- a/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml
+++ b/jero-boot/jero-boot-single-startup/src/main/resources/application-dev.yml
@@ -272,7 +272,7 @@ jero:
   # 文件限制后缀黑名单
   fileSuffixLimits : 0x00,%00,\\00,.jsp,.exe,.php,.asp,.aspx,.jspx,.xml,.html,.js,.sh,.bin
   # 跨站白名单
-  whiteUrls:
+  whiteUrls: localhost:3000
   # 加密默认值
   password:
     pbe: