diff --git a/commons/web-common/src/main/java/com/schbrain/common/web/DefaultCorsConfiguration.java b/commons/web-common/src/main/java/com/schbrain/common/web/DefaultCorsConfiguration.java
new file mode 100644
index 0000000000000000000000000000000000000000..5ee2e6aa5fd79013873a80ed3be81e5ff6ae7bdf
--- /dev/null
+++ b/commons/web-common/src/main/java/com/schbrain/common/web/DefaultCorsConfiguration.java
@@ -0,0 +1,45 @@
+package com.schbrain.common.web;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.cors.*;
+import org.springframework.web.filter.CorsFilter;
+
+import java.time.Duration;
+
+/**
+ * @author liaozan
+ * @since 2023-06-26
+ */
+@Configuration(proxyBeanMethods = false)
+public class DefaultCorsConfiguration {
+
+    @Bean
+    @ConditionalOnMissingBean
+    public CorsConfiguration defaultCorsConfiguration() {
+        CorsConfiguration config = new CorsConfiguration();
+        config.setAllowCredentials(true);
+        config.addAllowedOriginPattern(CorsConfiguration.ALL);
+        config.addAllowedMethod(CorsConfiguration.ALL);
+        config.addAllowedHeader(CorsConfiguration.ALL);
+        config.addExposedHeader(CorsConfiguration.ALL);
+        config.setMaxAge(Duration.ofDays(1));
+        return config;
+    }
+
+    @Bean
+    @ConditionalOnMissingBean
+    public CorsConfigurationSource defaultCorsConfigurationSource(CorsConfiguration corsConfiguration) {
+        UrlBasedCorsConfigurationSource configSource = new UrlBasedCorsConfigurationSource();
+        configSource.registerCorsConfiguration("/**", corsConfiguration);
+        return configSource;
+    }
+
+    @Bean
+    @ConditionalOnMissingBean
+    public CorsFilter defaultCorsFilter(CorsConfigurationSource corsConfigurationSource) {
+        return new CorsFilter(corsConfigurationSource);
+    }
+
+}
\ No newline at end of file
diff --git a/commons/web-common/src/main/java/com/schbrain/common/web/ServletComponentConfiguration.java b/commons/web-common/src/main/java/com/schbrain/common/web/ServletComponentConfiguration.java
index 9e8ea5df272a231f6727056b2e116298f49b3522..6216e999077ec260f0dbee80a00eeeade2573a96 100644
--- a/commons/web-common/src/main/java/com/schbrain/common/web/ServletComponentConfiguration.java
+++ b/commons/web-common/src/main/java/com/schbrain/common/web/ServletComponentConfiguration.java
@@ -1,8 +1,9 @@
 package com.schbrain.common.web;
 
-import com.schbrain.common.web.log.RequestLoggingFilter;
+import com.schbrain.common.web.servlet.RequestLoggingFilter;
 import com.schbrain.common.web.properties.WebProperties;
 import com.schbrain.common.web.servlet.CharacterEncodingServletContextInitializer;
+import com.schbrain.common.web.servlet.TraceIdInitializeServletListener;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.boot.web.servlet.filter.OrderedRequestContextFilter;
@@ -17,6 +18,12 @@ import org.springframework.web.filter.RequestContextFilter;
 @Configuration(proxyBeanMethods = false)
 public class ServletComponentConfiguration {
 
+    @Bean
+    @ConditionalOnMissingBean
+    public TraceIdInitializeServletListener traceIdInitializeServletListener() {
+        return new TraceIdInitializeServletListener();
+    }
+
     @Bean
     @ConditionalOnMissingBean
     public CharacterEncodingServletContextInitializer characterEncodingServletContextInitializer(WebProperties webProperties) {
diff --git a/commons/web-common/src/main/java/com/schbrain/common/web/WebCommonAutoConfiguration.java b/commons/web-common/src/main/java/com/schbrain/common/web/WebCommonAutoConfiguration.java
index e0cdd8705883454a0ffd4d21aaffef8adbe9bc26..a50d46a8b9a672a96e570b75d9b8efa4ac4f4ff7 100644
--- a/commons/web-common/src/main/java/com/schbrain/common/web/WebCommonAutoConfiguration.java
+++ b/commons/web-common/src/main/java/com/schbrain/common/web/WebCommonAutoConfiguration.java
@@ -3,8 +3,6 @@ package com.schbrain.common.web;
 import com.schbrain.common.web.argument.BodyParamArgumentResolverWebMvcConfigurer;
 import com.schbrain.common.web.properties.WebProperties;
 import com.schbrain.common.web.result.ResponseBodyHandler;
-import com.schbrain.common.web.servlet.AllowAnyOriginWithoutCredentialsCorsConfigurer;
-import com.schbrain.common.web.servlet.TraceIdInitializeServletListener;
 import org.springframework.beans.factory.BeanFactory;
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.boot.autoconfigure.AutoConfiguration;
@@ -25,7 +23,7 @@ import java.util.List;
 @AutoConfiguration
 @ConditionalOnWebApplication(type = Type.SERVLET)
 @EnableConfigurationProperties(WebProperties.class)
-@Import({AuthenticationConfiguration.class, ExceptionHandingConfiguration.class, ServletComponentConfiguration.class})
+@Import({AuthenticationConfiguration.class, ExceptionHandingConfiguration.class, ServletComponentConfiguration.class, DefaultCorsConfiguration.class})
 public class WebCommonAutoConfiguration {
 
     @Bean
@@ -53,16 +51,4 @@ public class WebCommonAutoConfiguration {
         return new ResponseBodyHandler(basePackages);
     }
 
-    @Bean
-    @ConditionalOnMissingBean
-    public TraceIdInitializeServletListener traceIdInitializeServletListener() {
-        return new TraceIdInitializeServletListener();
-    }
-
-    @Bean
-    @ConditionalOnMissingBean
-    public AllowAnyOriginWithoutCredentialsCorsConfigurer allowAnyOriginWithoutCredentialsCorsConfigurer() {
-        return new AllowAnyOriginWithoutCredentialsCorsConfigurer();
-    }
-
 }
\ No newline at end of file
diff --git a/commons/web-common/src/main/java/com/schbrain/common/web/servlet/AllowAnyOriginWithoutCredentialsCorsConfigurer.java b/commons/web-common/src/main/java/com/schbrain/common/web/servlet/AllowAnyOriginWithoutCredentialsCorsConfigurer.java
deleted file mode 100644
index 7b3efdfd5320e15c03f8d5416ee207259dd0e77d..0000000000000000000000000000000000000000
--- a/commons/web-common/src/main/java/com/schbrain/common/web/servlet/AllowAnyOriginWithoutCredentialsCorsConfigurer.java
+++ /dev/null
@@ -1,26 +0,0 @@
-package com.schbrain.common.web.servlet;
-
-import org.springframework.web.cors.CorsConfiguration;
-import org.springframework.web.servlet.config.annotation.CorsRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
-
-import java.time.Duration;
-
-/**
- * @author liaozan
- * @since 2022/11/19
- */
-public class AllowAnyOriginWithoutCredentialsCorsConfigurer implements WebMvcConfigurer {
-
-    @Override
-    public void addCorsMappings(CorsRegistry registry) {
-        registry.addMapping("/**")
-                .allowCredentials(false)
-                .allowedOrigins(CorsConfiguration.ALL)
-                .allowedHeaders(CorsConfiguration.ALL)
-                .allowedMethods(CorsConfiguration.ALL)
-                .exposedHeaders(CorsConfiguration.ALL)
-                .maxAge(Duration.ofHours(1).toSeconds());
-    }
-
-}
\ No newline at end of file
diff --git a/commons/web-common/src/main/java/com/schbrain/common/web/log/RequestLoggingFilter.java b/commons/web-common/src/main/java/com/schbrain/common/web/servlet/RequestLoggingFilter.java
similarity index 98%
rename from commons/web-common/src/main/java/com/schbrain/common/web/log/RequestLoggingFilter.java
rename to commons/web-common/src/main/java/com/schbrain/common/web/servlet/RequestLoggingFilter.java
index 2f18cd8ab8ed28f2fc4c3d0420d7873469d4e955..5b57256571b9115e1e5ed45e622297d9e41919e7 100644
--- a/commons/web-common/src/main/java/com/schbrain/common/web/log/RequestLoggingFilter.java
+++ b/commons/web-common/src/main/java/com/schbrain/common/web/servlet/RequestLoggingFilter.java
@@ -1,4 +1,4 @@
-package com.schbrain.common.web.log;
+package com.schbrain.common.web.servlet;
 
 import cn.hutool.core.text.CharPool;
 import cn.hutool.core.util.ArrayUtil;