diff --git a/main.go b/main.go
index 0c7c360..5292d00 100644
--- a/main.go
+++ b/main.go
@@ -2,12 +2,10 @@ package main
 
 import (
 	"crypto/aes"
-	"crypto/cipher"
 	"crypto/sha1"
 	"embed"
 	"encoding/base64"
 	"errors"
-	"fmt"
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v4"
 	log "github.com/sirupsen/logrus"
@@ -46,31 +44,32 @@ func main() {
 	r := gin.Default()
 	// r.Use(cors.Default())
 	r.Use(Cors())
+	r.Use(m.JWTAuthMiddleware)
 
 	fp, _ := fs.Sub(f, "static")
 	r.StaticFS("/static", http.FS(fp))
 
-	r.GET("/index", m.JWTAuthMiddleware, func(c *gin.Context) {
-		c.FileFromFS("/template/app_view.html", http.FS(f))
-	})
-	r.GET("/apps", m.JWTAuthMiddleware, controller.GetAppsController)
-	r.POST("/app", m.JWTAuthMiddleware, controller.CreateUpdateDeleteApp)
-	r.PUT("/app", m.JWTAuthMiddleware, controller.CreateUpdateDeleteApp)
-	r.DELETE("/app", m.JWTAuthMiddleware, controller.CreateUpdateDeleteApp)
+	//r.GET("/index", func(c *gin.Context) {
+	//	c.FileFromFS("/template/app_view.html", http.FS(f))
+	//})
+	r.GET("/apps", controller.GetAppsController)
+	r.POST("/app", controller.CreateUpdateDeleteApp)
+	r.PUT("/app", controller.CreateUpdateDeleteApp)
+	r.DELETE("/app", controller.CreateUpdateDeleteApp)
 
-	r.POST("/dep", m.JWTAuthMiddleware, controller.CreateDeleteDeployment)
-	r.DELETE("/dep", m.JWTAuthMiddleware, controller.CreateDeleteDeployment)
+	r.POST("/dep", controller.CreateDeleteDeployment)
+	r.DELETE("/dep", controller.CreateDeleteDeployment)
 
-	r.GET("/pod", m.JWTAuthMiddleware, controller.GetPodStatus)
+	r.GET("/pod", controller.GetPodStatus)
 
 	r.GET("/login", LoginToken)
 	r.Any("/test_token", TestToken)
-	r.GET("/username", m.JWTAuthMiddleware, controller.GetUsername)
+	r.GET("/username", controller.GetUsername)
 
-	r.GET("/files/:app", m.JWTAuthMiddleware, controller.GetFiles)
-	r.GET("/file/:app/:filename", m.JWTAuthMiddleware, controller.GetPostOrDeleteFile)
-	r.POST("/file/:app/:filename", m.JWTAuthMiddleware, controller.GetPostOrDeleteFile)
-	r.DELETE("/file/:app/:filename", m.JWTAuthMiddleware, controller.GetPostOrDeleteFile)
+	r.GET("/files/:app", controller.GetFiles)
+	r.GET("/file/:app/:filename", controller.GetPostOrDeleteFile)
+	r.POST("/file/:app/:filename", controller.GetPostOrDeleteFile)
+	r.DELETE("/file/:app/:filename", controller.GetPostOrDeleteFile)
 
 	err := r.Run(":8000")
 	if err != nil {
@@ -109,16 +108,17 @@ func ParseCGToken(token string) (string, error) {
 	return "", errors.New("jwt parse error")
 }
 
-func generateKey(key []byte) (genKey []byte) {
-	genKey = make([]byte, 16)
-	copy(genKey, key)
-	for i := 16; i < len(key); {
-		for j := 0; j < 16 && i < len(key); j, i = j+1, i+1 {
-			genKey[j] ^= key[i]
-		}
-	}
-	return genKey
-}
+//func generateKey(key []byte) (genKey []byte) {
+//	genKey = make([]byte, 16)
+//	copy(genKey, key)
+//	for i := 16; i < len(key); {
+//		for j := 0; j < 16 && i < len(key); j, i = j+1, i+1 {
+//			genKey[j] ^= key[i]
+//		}
+//	}
+//	return genKey
+//}
+
 func AesDecryptECB(encrypted []byte, key []byte) (decrypted []byte) {
 	sh := sha1.New()
 	sh.Write(key)
@@ -141,34 +141,31 @@ func AesDecryptECB(encrypted []byte, key []byte) (decrypted []byte) {
 	return decrypted[:trim]
 }
 
-func AesDecrypt(data []byte, key []byte) ([]byte, error) {
-	sh := sha1.New()
-	sh.Write(key)
-	realKey := sh.Sum(nil)
-
-	fmt.Println(string(realKey))
-	block, err := aes.NewCipher(realKey[:16])
-	if err != nil {
-		log.WithError(err).Error("AesDecrypt 1")
-		return nil, err
-	}
-	blockSize := block.BlockSize()
-	blockMode := cipher.NewCBCDecrypter(block, key[:blockSize])
-	crypted := make([]byte, len(data))
-	blockMode.CryptBlocks(crypted, data)
-	if err != nil {
-		log.WithError(err).Error("AesDecrypt 2")
-		return nil, err
-	}
-	return crypted, nil
-}
+//func AesDecrypt(data []byte, key []byte) ([]byte, error) {
+//	sh := sha1.New()
+//	sh.Write(key)
+//	realKey := sh.Sum(nil)
+//
+//	fmt.Println(string(realKey))
+//	block, err := aes.NewCipher(realKey[:16])
+//	if err != nil {
+//		log.WithError(err).Error("AesDecrypt 1")
+//		return nil, err
+//	}
+//	blockSize := block.BlockSize()
+//	blockMode := cipher.NewCBCDecrypter(block, key[:blockSize])
+//	crypted := make([]byte, len(data))
+//	blockMode.CryptBlocks(crypted, data)
+//	if err != nil {
+//		log.WithError(err).Error("AesDecrypt 2")
+//		return nil, err
+//	}
+//	return crypted, nil
+//}
 
 func LoginToken(c *gin.Context) {
-	username := c.Request.URL.Query().Get("username")
-	var err error
-	if username == "" {
-		username, err = ParseCGToken(c.Request.URL.Query().Get("cgtoken"))
-	}
+	//username := c.Request.URL.Query().Get("username")
+	username, err := ParseCGToken(c.Request.URL.Query().Get("cgtoken"))
 	if username == "" || err != nil {
 		c.JSON(http.StatusNotFound, gin.H{
 			"code": http.StatusNotFound,
diff --git a/src/jwt_utils.go b/src/jwt_utils.go
index 0611f8e..b99d8ea 100644
--- a/src/jwt_utils.go
+++ b/src/jwt_utils.go
@@ -44,6 +44,10 @@ func ParseToken(tokenString string) (*MyClaims, error) {
 }
 
 func JWTAuthMiddleware(c *gin.Context) {
+	if c.Request.URL.Query().Get("cgtoken") != "" {
+		// 登录过程，不验证身份
+		return
+	}
 	authHeader := c.Request.Header.Get("Authorization")
 	if authHeader == "" {
 		var err error