diff --git a/config/types.go b/config/types.go
index 33d6f6f0..123d7c37 100644
--- a/config/types.go
+++ b/config/types.go
@@ -11,8 +11,9 @@ type Config struct {
 	Log     string `json:"log,omitempty" env:"YAO_LOG"`                             // 服务日志地址
 	LogMode string `json:"log_mode,omitempty" env:"YAO_LOG_MODE" envDefault:"TEXT"` // 服务日志模式 JSON|TEXT
 	// Session   string        `json:"session,omitempty" env:"YAO_SESSION" envDefault:"memory"`         // 用户会话模式 memory|redis|database
-	JWTSecret string        `json:"jwt_secret,omitempty" env:"YAO_JWT_SECRET"` // JWT 密钥
-	DB        DBConfig      `json:"db,omitempty"`                              // 数据库配置
+	JWTSecret string        `json:"jwt_secret,omitempty" env:"YAO_JWT_SECRET"`                  // JWT 密钥
+	DB        DBConfig      `json:"db,omitempty"`                                               // 数据库配置
+	AllowFrom []string      `json:"allowfrom,omitempty" envSeparator:"|" env:"YAO_ALLOW_FROM" ` // Domain list the separator is |
 	Session   SessionConfig `json:"session,omitempty"`
 }
 
diff --git a/service/service.go b/service/service.go
index 304d1e1b..51858b99 100644
--- a/service/service.go
+++ b/service/service.go
@@ -19,9 +19,10 @@ func Start() {
 	gou.SetHTTPGuards(Guards)
 	gou.ServeHTTP(
 		gou.Server{
-			Host: config.Conf.Host,
-			Port: config.Conf.Port,
-			Root: "/api",
+			Host:   config.Conf.Host,
+			Port:   config.Conf.Port,
+			Root:   "/api",
+			Allows: config.Conf.AllowFrom,
 		},
 		&shutdown, func(s gou.Server) {
 			shutdownComplete <- true
@@ -35,9 +36,10 @@ func StartWithouttSession() {
 	gou.SetHTTPGuards(Guards)
 	gou.ServeHTTP(
 		gou.Server{
-			Host: config.Conf.Host,
-			Port: config.Conf.Port,
-			Root: "/api",
+			Host:   config.Conf.Host,
+			Port:   config.Conf.Port,
+			Root:   "/api",
+			Allows: config.Conf.AllowFrom,
 		},
 		&shutdown, func(s gou.Server) {
 			shutdownComplete <- true