diff --git a/target/fwutils/request_config.lua b/target/fwutils/request_config.lua
index e4d3673..9c7ef54 100644
--- a/target/fwutils/request_config.lua
+++ b/target/fwutils/request_config.lua
@@ -29,14 +29,13 @@ M.init = function(website_config)
     if M.__url_param ~= nil then
         M.__action = M.__url_param["action"]
     end
-    -- 获取TOKEN 
-    local token = string.match(request.header("Cookie"),"token=(%w+)")
+    -- 获取TOKEN 优先顺序: X-Auth-Token -> Cookie.token -> url的token
+    local token = request.header("X-Auth-Token")
     if token == nil or token == "" then
-        token = M.__url_param["token"] 
-        if token ~= nil then
-            response.header("Set-Cookie","token="..token..";Path=/")    
+        token = M.__url_param["token"]
+        if token == nil or token == "" then
+            token = string.match(request.header("Cookie"),"token=(%w+)")
         end
-        
     end
     if token ~= nil and token ~= "" then
         local result,user_data = token_module.get(token)