diff --git a/framework/gateway/src/main/java/io/metersphere/gateway/filter/SessionFilter.java b/framework/gateway/src/main/java/io/metersphere/gateway/filter/SessionFilter.java
index c65a441ac2..e0461b0276 100644
--- a/framework/gateway/src/main/java/io/metersphere/gateway/filter/SessionFilter.java
+++ b/framework/gateway/src/main/java/io/metersphere/gateway/filter/SessionFilter.java
@@ -18,7 +18,7 @@ import java.util.Optional;
 public class SessionFilter implements WebFilter {
     // 所有模块的前缀
     private static final String[] PREFIX = new String[]{"/setting", "/project", "/api", "/performance", "/track", "/workstation", "/ui", "/report"};
-    private static final String[] TO_SUB_SERVICE = new String[]{"/license", "/system"};
+    private static final String[] TO_SUB_SERVICE = new String[]{"/license", "/system", "/resource"};
     private static final String PERFORMANCE_DOWNLOAD_PREFIX = "/jmeter/";
     private static final String API_DOWNLOAD_PREFIX = "/api/jmeter/";
 
diff --git a/framework/sdk-parent/frontend/src/plugins/request.js b/framework/sdk-parent/frontend/src/plugins/request.js
index ec0455ace8..d8e73d38fa 100644
--- a/framework/sdk-parent/frontend/src/plugins/request.js
+++ b/framework/sdk-parent/frontend/src/plugins/request.js
@@ -268,6 +268,14 @@ export const generateShareUrl = (name, shareUrl) => {
   }
 }
 
+export const generateModuleUrl = (url) => {
+  if (window.__POWERED_BY_QIANKUN__) {
+    return window.location.origin + '/' + packageJSON.name + url;
+  } else {
+    return window.location.origin + url;
+  }
+}
+
 export default {
   install(Vue) {
     Vue.prototype.$get = get;
diff --git a/framework/sdk-parent/sdk/src/main/java/io/metersphere/commons/utils/ShiroUtils.java b/framework/sdk-parent/sdk/src/main/java/io/metersphere/commons/utils/ShiroUtils.java
index e38798ce7f..30207e3fff 100644
--- a/framework/sdk-parent/sdk/src/main/java/io/metersphere/commons/utils/ShiroUtils.java
+++ b/framework/sdk-parent/sdk/src/main/java/io/metersphere/commons/utils/ShiroUtils.java
@@ -17,6 +17,7 @@ public class ShiroUtils {
 
         filterChainDefinitionMap.put("/resource/md/get/**", "anon");
         filterChainDefinitionMap.put("/resource/ui/get/**", "anon");
+        filterChainDefinitionMap.put("/attachment/preview/**", "anon");
         filterChainDefinitionMap.put("/*.worker.js", "anon");
         filterChainDefinitionMap.put("/signin", "anon");
         filterChainDefinitionMap.put("/ldap/signin", "anon");
@@ -90,8 +91,6 @@ public class ShiroUtils {
     public static void ignoreCsrfFilter(Map<String, String> filterChainDefinitionMap) {
         filterChainDefinitionMap.put("/", "apikey, authc"); // 跳转到 / 不用校验 csrf
         filterChainDefinitionMap.put("/language", "apikey, authc");// 跳转到 /language 不用校验 csrf
-        filterChainDefinitionMap.put("/test/case/file/preview/**", "apikey, authc"); // 预览测试用例附件 不用校验 csrf
-        filterChainDefinitionMap.put("/attachment/preview/**", "apikey, authc"); // 预览缺陷及测试用例附件 不用校验 csrf
         filterChainDefinitionMap.put("/mock", "apikey, authc"); // 跳转到 /mock接口 不用校验 csrf
     }
 
diff --git a/test-track/frontend/src/business/case/components/TestCaseFile.vue b/test-track/frontend/src/business/case/components/TestCaseFile.vue
index bf292c8576..662752526e 100644
--- a/test-track/frontend/src/business/case/components/TestCaseFile.vue
+++ b/test-track/frontend/src/business/case/components/TestCaseFile.vue
@@ -1,7 +1,7 @@
 <template>
   <el-dialog :visible.sync="dialogVisible" width="80%" :destroy-on-close="true" :before-close="close" :append-to-body="true">
     <div>
-      <img :src="'/attachment/preview/' + file.id + '/' + file.isLocal" :alt="$t('test_track.case.img_loading_fail')" style="width: 100%;height: 100%;"
+      <img :src="url" :alt="$t('test_track.case.img_loading_fail')" style="width: 100%;height: 100%;"
            v-if="file.type === 'JPG' || file.type === 'JPEG' || file.type === 'PNG'">
       <div v-if="file.type === 'PDF'">
         <test-case-pdf :file-id="file.id"/>
@@ -13,6 +13,7 @@
 <script>
 
 import TestCasePdf from "@/business/case/components/TestCasePdf";
+import {generateModuleUrl} from "@/business/utils/sdk-utils";
 
 export default {
   name: "TestCaseFiles",
@@ -25,12 +26,14 @@ export default {
         type: ''
       },
       dialogVisible: false,
+      url: ''
     }
   },
   methods: {
     open(file) {
       this.file = file;
       this.dialogVisible = true;
+      this.url = generateModuleUrl('/attachment/preview/' + this.file.id + '/' + this.file.isLocal);
     },
     close() {
       this.file = {
diff --git a/test-track/frontend/src/business/utils/sdk-utils.js b/test-track/frontend/src/business/utils/sdk-utils.js
index 982b3293eb..27e8d3acc7 100644
--- a/test-track/frontend/src/business/utils/sdk-utils.js
+++ b/test-track/frontend/src/business/utils/sdk-utils.js
@@ -2,7 +2,7 @@ export {operationConfirm, removeGoBackListener, handleCtrlSEvent, byteToSize, ge
 export {parseCustomFilesForList, getCustomFieldFilter, buildBatchParam} from "metersphere-frontend/src/utils/tableUtils";
 export {getCurrentProjectID, getCurrentWorkspaceId, getCurrentUser} from "metersphere-frontend/src/utils/token";
 export {hasLicense, hasPermissions, hasPermission} from "metersphere-frontend/src/utils/permission";
-export {get, post, downloadFile, fileDownloadGet, fileDownloadPost, fileUpload} from "metersphere-frontend/src/plugins/request";
+export {get, post, downloadFile, fileDownloadGet, fileDownloadPost, fileUpload, generateShareUrl, generateModuleUrl} from "metersphere-frontend/src/plugins/request";
 export {CURRENT_LANGUAGE} from "metersphere-frontend/src/utils/constants";