diff --git a/modules/core/src/main/resources/config/jeesite-core.yml b/modules/core/src/main/resources/config/jeesite-core.yml
index ac30792a..d5803e80 100644
--- a/modules/core/src/main/resources/config/jeesite-core.yml
+++ b/modules/core/src/main/resources/config/jeesite-core.yml
@@ -406,7 +406,7 @@ shiro:
   # 允许跨域访问时 CORS，可以获取和返回的方法和请求头
   #accessControlAllowMethods: GET, POST, OPTIONS
   #accessControlAllowHeaders: content-type, x-requested-with, x-ajax, x-token, x-remember
-  #accessControlExposeHeaders: x-remember
+  #accessControlExposeHeaders: x-token, x-remember
   
   # 是否允许接收跨域的Cookie凭证数据 CORS
   #accessControlAllowCredentials: false
diff --git a/web-api/src/main/resources/config/application.yml b/web-api/src/main/resources/config/application.yml
index 3e69996e..3ad0bf21 100644
--- a/web-api/src/main/resources/config/application.yml
+++ b/web-api/src/main/resources/config/application.yml
@@ -586,7 +586,7 @@ shiro:
 #  # 允许跨域访问时 CORS，可以获取和返回的方法和请求头
 #  accessControlAllowMethods: GET, POST, OPTIONS
 #  accessControlAllowHeaders: content-type, x-requested-with, x-ajax, x-token, x-remember
-#  accessControlExposeHeaders: x-remember
+#  accessControlExposeHeaders: x-token, x-remember
 
 #  # 是否允许接收跨域的Cookie凭证数据 CORS
 #  accessControlAllowCredentials: false
diff --git a/web-fast/src/main/resources/config/application.yml b/web-fast/src/main/resources/config/application.yml
index 38620050..131a796e 100644
--- a/web-fast/src/main/resources/config/application.yml
+++ b/web-fast/src/main/resources/config/application.yml
@@ -172,7 +172,7 @@ shiro:
   # 允许跨域访问时 CORS，可以获取和返回的方法和请求头
   accessControlAllowMethods: GET, POST, OPTIONS
   accessControlAllowHeaders: content-type, x-requested-with, x-ajax, x-token, x-remember
-  accessControlExposeHeaders: x-remember
+  accessControlExposeHeaders: x-token, x-remember
 
 # Session 相关
 session:
diff --git a/web/src/main/resources/config/application.yml b/web/src/main/resources/config/application.yml
index 879b66c3..1e7b4688 100644
--- a/web/src/main/resources/config/application.yml
+++ b/web/src/main/resources/config/application.yml
@@ -586,7 +586,7 @@ shiro:
 #  # 允许跨域访问时 CORS，可以获取和返回的方法和请求头
 #  accessControlAllowMethods: GET, POST, OPTIONS
 #  accessControlAllowHeaders: content-type, x-requested-with, x-ajax, x-token, x-remember
-#  accessControlExposeHeaders: x-remember
+#  accessControlExposeHeaders: x-token, x-remember
 
 #  # 是否允许接收跨域的Cookie凭证数据 CORS
 #  accessControlAllowCredentials: false