diff --git a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java
index 381d37ade..27a6a35b9 100644
--- a/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java
+++ b/pigx-visual/pigx-oa-platform/src/main/java/com/pig4cloud/pigx/act/controller/EditorController.java
@@ -18,7 +18,6 @@
 package com.pig4cloud.pigx.act.controller;
 
 import com.pig4cloud.pigx.act.service.EditorService;
-import com.pig4cloud.pigx.common.security.annotation.Inner;
 import com.pig4cloud.pigx.common.xss.core.XssCleanIgnore;
 import lombok.AllArgsConstructor;
 import org.springframework.web.bind.annotation.*;
@@ -27,7 +26,6 @@ import org.springframework.web.bind.annotation.*;
  * @author lengleng
  * @date 2018/4/13
  */
-@Inner(value = false)
 @RestController
 @AllArgsConstructor
 @RequestMapping("/service")
diff --git a/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/app.js b/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/app.js
index 6143865e8..3ec8d2eaf 100644
--- a/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/app.js
+++ b/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/app.js
@@ -99,12 +99,18 @@ activitiModeler
                   tenantId = JSON.parse(localStorage.getItem('pigx-tenantId')).content
                 }
 
+                var token = ''
+                if (sessionStorage.getItem('pigx-access_token')){
+                  token = JSON.parse(sessionStorage.getItem('pigx-access_token')).content
+                }
+
                 var modelUrl = KISBPM.URL.getModel(modelId);
 
                 $http({method: 'GET',
                     url: modelUrl,
                    headers: {
-                    'TENANT-ID': tenantId
+                     'Authorization': 'Bearer '+token,
+                     'TENANT-ID': tenantId
                    }
                 }).
                     success(function (data, status, headers, config) {
diff --git a/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/configuration/toolbar-default-actions.js b/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/configuration/toolbar-default-actions.js
index e3c06f313..0712eaed6 100644
--- a/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/configuration/toolbar-default-actions.js
+++ b/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/configuration/toolbar-default-actions.js
@@ -382,6 +382,11 @@ var SaveModelCtrl = [ '$rootScope', '$scope', '$http', '$route', '$location',
           tenantId = JSON.parse(localStorage.getItem('pigx-tenantId')).content
         }
 
+        var token = ''
+        if (sessionStorage.getItem('pigx-access_token')){
+          token = JSON.parse(sessionStorage.getItem('pigx-access_token')).content
+        }
+
         // Update
           $http({    method: 'PUT',
             data: params,
@@ -389,7 +394,8 @@ var SaveModelCtrl = [ '$rootScope', '$scope', '$http', '$route', '$location',
             headers: {
                       'Accept': 'application/json',
                       'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
-                      'TENANT-ID': tenantId
+                      'TENANT-ID': tenantId,
+                      'Authorization': 'Bearer '+token,
             },
             transformRequest: function (obj) {
                 var str = [];
diff --git a/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/libs/prototype-1.5.1.js b/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/libs/prototype-1.5.1.js
index b3f19f49d..5515bbdc8 100644
--- a/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/libs/prototype-1.5.1.js
+++ b/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/libs/prototype-1.5.1.js
@@ -446,7 +446,7 @@ var Enumerable = {
         iterator(value, index++);
       });
     } catch (e) {
-      if (e != $break) 
+      if (e != $break)
     	  throw e;
     }
     return this;
@@ -1061,10 +1061,22 @@ Ajax.Request.prototype = Object.extend(new Ajax.Base(), {
   },
 
   setRequestHeaders: function() {
+    var tenantId  = 1
+    if (localStorage.getItem('pigx-tenantId')) {
+      tenantId = JSON.parse(localStorage.getItem('pigx-tenantId')).content
+    }
+
+    var token = ''
+    if (sessionStorage.getItem('pigx-access_token')){
+      token = JSON.parse(sessionStorage.getItem('pigx-access_token')).content
+    }
+
     var headers = {
       'X-Requested-With': 'XMLHttpRequest',
       'X-Prototype-Version': Prototype.Version,
-      'Accept': 'text/javascript, text/html, application/xml, text/xml, */*'
+      'Accept': 'text/javascript, text/html, application/xml, text/xml, */*',
+      'TENANT-ID': tenantId,
+      'Authorization': 'Bearer '+token,
     };
 
     if (this.method == 'post') {
@@ -3269,4 +3281,4 @@ if (Prototype.Browser.WebKit) {
   }
 }
 
-Element.addMethods();
\ No newline at end of file
+Element.addMethods();
diff --git a/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/stencil-controller.js b/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/stencil-controller.js
index 75796d863..95d57129a 100644
--- a/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/stencil-controller.js
+++ b/pigx-visual/pigx-oa-platform/src/main/resources/static/editor-app/stencil-controller.js
@@ -67,9 +67,15 @@ angular.module('activitiModeler')
               tenantId = JSON.parse(localStorage.getItem('pigx-tenantId')).content
             }
 
+            var token = ''
+            if (sessionStorage.getItem('pigx-access_token')){
+              token = JSON.parse(sessionStorage.getItem('pigx-access_token')).content
+            }
+
             $http({method: 'GET',
                 url: KISBPM.URL.getStencilSet(),
                 headers: {
+                  'Authorization': 'Bearer '+token,
                   'TENANT-ID': tenantId
                 }
             }).success(function (data, status, headers, config) {