diff --git a/kicc-common/kicc-common-security/src/main/java/com/cloud/kicc/common/security/xss/XssFilterAutoConfiguration.java b/kicc-common/kicc-common-security/src/main/java/com/cloud/kicc/common/security/xss/XssFilterAutoConfiguration.java
index bc0825a6..7acdc008 100644
--- a/kicc-common/kicc-common-security/src/main/java/com/cloud/kicc/common/security/xss/XssFilterAutoConfiguration.java
+++ b/kicc-common/kicc-common-security/src/main/java/com/cloud/kicc/common/security/xss/XssFilterAutoConfiguration.java
@@ -1,5 +1,6 @@
 package com.cloud.kicc.common.security.xss;
 
+import cn.hutool.core.util.ObjectUtil;
 import cn.hutool.core.util.StrUtil;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.boot.web.servlet.FilterRegistrationBean;
@@ -29,8 +30,8 @@ public class XssFilterAutoConfiguration {
         registration.setName("xssFilter");
         registration.setOrder(FilterRegistrationBean.HIGHEST_PRECEDENCE);
         Map<String, String> initParameters = new HashMap();
-        initParameters.put("excludes", xssProperties.getExcludes());
-        initParameters.put("enabled", xssProperties.getEnabled());
+        initParameters.put("excludes", ObjectUtil.defaultIfNull(xssProperties.getExcludes(), ""));
+        initParameters.put("enabled", ObjectUtil.defaultIfNull(xssProperties.getEnabled(), ""));
         registration.setInitParameters(initParameters);
         return registration;
     }