diff --git a/src/main/java/com/filesystem/config/SecurityConfig.java b/src/main/java/com/filesystem/config/SecurityConfig.java
index 3e2b5db..fd1aed8 100644
--- a/src/main/java/com/filesystem/config/SecurityConfig.java
+++ b/src/main/java/com/filesystem/config/SecurityConfig.java
@@ -50,7 +50,7 @@ public class SecurityConfig {
                 // WebSocket
                 .requestMatchers("/ws/**").permitAll()
                 // 静态资源
-                .requestMatchers("/webapp/**", "/assets/**", "/uploads/**", "/files/avatar/**", "/api/files/avatar/**", "/api/messages/file/**").permitAll()
+                .requestMatchers("/webapp/**", "/assets/**", "/uploads/**", "/files/avatar/**", "/api/files/avatar/**", "/api/messages/file/**", "/api/messages/conversation/**").permitAll()
                 // 前端页面路由（所有非 /api/ 的路由，由 Vue Router 处理）
                 .requestMatchers("/", "/login", "/register", "/desktop/**", "/favicon.ico").permitAll()
                 // 其他所有请求需要认证