diff --git a/middleware/access-control.js b/middleware/access-control.js
index 0ad4ed104..0709bd519 100644
--- a/middleware/access-control.js
+++ b/middleware/access-control.js
@@ -1,10 +1,9 @@
 const art = require('art-template');
 const path = require('path');
+const blacklist = (process.env.BLACKLIST && process.env.BLACKLIST.split(',')) || [];
+const whitelist = process.env.WHITELIST && process.env.WHITELIST.split(',');
 
 module.exports = async (ctx, next) => {
-    const blacklist = (process.env.BLACKLIST && process.env.BLACKLIST.split(',')) || [];
-    const whitelist = process.env.WHITELIST && process.env.WHITELIST.split(',');
-
     const ip = ctx.ips[0] || ctx.ip;
     const requestPath = ctx.request.path;
 
diff --git a/middleware/header.js b/middleware/header.js
index 87a9b5cb2..3a7a997a0 100644
--- a/middleware/header.js
+++ b/middleware/header.js
@@ -1,16 +1,15 @@
 const logger = require('../utils/logger');
 const config = require('../config');
+const headers = {
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Headers': 'Content-Type, Content-Length, Authorization, Accept, X-Requested-With , yourHeaderFeild',
+    'Access-Control-Allow-Methods': 'PUT, POST, GET, DELETE, OPTIONS',
+    'Content-Type': 'application/xml; charset=utf-8',
+    'Cache-Control': `max-age=${config.cacheExpire / 2}`,
+};
 
 module.exports = async (ctx, next) => {
     logger.info(`${ctx.url}, user IP: ${ctx.ips[0] || ctx.ip}`);
-
-    const headers = {
-        'Access-Control-Allow-Origin': '*',
-        'Access-Control-Allow-Headers': 'Content-Type, Content-Length, Authorization, Accept, X-Requested-With , yourHeaderFeild',
-        'Access-Control-Allow-Methods': 'PUT, POST, GET, DELETE, OPTIONS',
-        'Content-Type': 'application/xml; charset=utf-8',
-        'Cache-Control': `max-age=${config.cacheExpire / 2}`,
-    };
     ctx.set(headers);
     await next();
 };