diff --git a/src/jobs/jobs.js b/src/jobs/jobs.js
index fcfb0d1..44e722c 100644
--- a/src/jobs/jobs.js
+++ b/src/jobs/jobs.js
@@ -144,7 +144,7 @@ async function confirm (job = mock, done = mock) {
         mylog.info(`用户${fund.userId} 共更新${acc}条`);
         job.touch();
     });
-    return done('矿晶确认完成');
+    return typeof done === 'function' && done('矿晶确认完成');
 }
 const jobs = [
     {
diff --git a/src/service/middleware.js b/src/service/middleware.js
index 326185d..70ccbc6 100644
--- a/src/service/middleware.js
+++ b/src/service/middleware.js
@@ -1,11 +1,23 @@
 const { inject } = require('../common/Provider');
 const { verifyToken, createToken } = require('../utils/jwt');
+const crypto = require('../utils/crypto');
+
 const ignoreToken = ['/sign/check', '/sign/in', '/sign/up', '/sign/upwi', '/sign/forget', '/sign/send', '/sign/changePwd', '/sign/code'];
 module.exports = {
     auth: inject(function (SysConfig) {
         const { JWT_SECRET } = SysConfig;
+        if (!SysConfig.LIMITSALT) mylog.error('缺少限流密钥');
         return async (req, res, next) => {
             const token = req.headers.token;
+            if (ignoreToken.includes(req.path)) {
+                const { sig, ts } = req.headers;
+                const salt = SysConfig.LIMITSALT;
+                const my = crypto.hash(ts + req.path + salt, { hasher: 'md5' });
+                const invalid = sig !== my || Date.now() - ts > 60000;
+                if (invalid) {
+                    return res.status(403).send('unauthorized');
+                }
+            }
             if(!ignoreToken.includes(req.path)) {
                 if (token) {
                     const deToken = await verifyToken(token, JWT_SECRET);
diff --git a/src/utils/crypto.js b/src/utils/crypto.js
index 170f3c9..749d908 100644
--- a/src/utils/crypto.js
+++ b/src/utils/crypto.js
@@ -66,7 +66,7 @@ module.exports = {
             let outputEncoding = (option.output === 'buf') ? undefined : (my.OUTPUT_LIST.indexOf(option.output) >= 0 ? option.output : my.OUTPUT); // 'latin1', 'base64', 'hex' by default or 'buf' to Buffer explicitly
             let cipher = crypto.createCipher(
                 my.CIPHER_LIST.indexOf(option.cipher) >= 0 ? option.cipher : my.CIPHER,
-                this.hash(pwd));
+                this.hash(pwd, option)); //哈希加盐
             if (typeof (data) !== 'string' && !(data instanceof Buffer) && !(data instanceof DataView))
                 data = JSON.stringify(data);
             let encrypted = cipher.update(data, inputEncoding, outputEncoding);
@@ -83,15 +83,13 @@ module.exports = {
             let outputEncoding = (option.output === 'buf') ? undefined : (my.INPUT_LIST.indexOf(option.output) >= 0 ? option.output : my.INPUT); // output (=input of encrypt) could be 'latin1', 'ascii', 'utf8' by default or  'buf' to Buffer explicitly
             let decipher = crypto.createDecipher(
                 my.CIPHER_LIST.indexOf(option.cipher) >= 0 ? option.cipher : my.CIPHER,
-                this.hash(pwd));
+                this.hash(pwd, option)); // 哈希加盐
             let decrypted = decipher.update(data, inputEncoding, outputEncoding);
             decrypted += decipher.final(outputEncoding); // 但是 Buffer + Buffer 还是会变成string
-            if (option.format === 'json') { // 如果用户输入错误密码，deciper也能返回结果。为了判断是否正确结果，对应当是 json 格式的原文做解析来验证。
-                try {
-                    JSON.parse(decrypted);
-                } catch (exception) {
-                    return null;
-                }
+            try {
+                JSON.parse(decrypted);
+            } catch (exception) {
+                return null;
             }
             return decrypted;
         }