diff --git a/src/main/java/com/alist/api/config/SecurityConfig.java b/src/main/java/com/alist/api/config/SecurityConfig.java
index 6e92219..d5af29a 100644
--- a/src/main/java/com/alist/api/config/SecurityConfig.java
+++ b/src/main/java/com/alist/api/config/SecurityConfig.java
@@ -59,7 +59,10 @@ public class SecurityConfig {
 				.cors(Customizer.withDefaults())
 				.csrf(csrf -> csrf.disable())
 				.authorizeHttpRequests(auth -> auth
-						.requestMatchers("/admin/auth/**").permitAll()
+						.requestMatchers(
+								"/admin/auth/**"
+								, "/admin/files/**"
+						).permitAll()
 						.anyRequest().hasRole("ADMIN")
 				)
 				.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
@@ -78,7 +81,17 @@ public class SecurityConfig {
 						.accessDeniedHandler(new JwtAccessDeniedHandler())
 				)
 				.authorizeHttpRequests(auth -> auth
-						.requestMatchers("/", "/actuator/health", "/sso/**", "/auth/**", "/user/signup", "/user/migrationUserList", "/tusFiles/tusHook", "/tusFiles/uploadAuth").permitAll()
+						.requestMatchers(
+								"/"
+								, "/actuator/health"
+								, "/sso/**"
+								, "/auth/**"
+								, "/user/signup"
+								, "/user/migrationUserList"
+								, "/tusFiles/tusHook"
+								, "/tusFiles/uploadAuth"
+								, "/files/**"
+						).permitAll()
 						.anyRequest().authenticated()
 				)
 				.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);