diff --git a/ruoyi-admin/src/main/resources/application.yml b/ruoyi-admin/src/main/resources/application.yml
index cab196471..e045cefd0 100644
--- a/ruoyi-admin/src/main/resources/application.yml
+++ b/ruoyi-admin/src/main/resources/application.yml
@@ -273,4 +273,7 @@ websocket:
 warm-flow:
   # 是否开启工作流，默认true
   enabled: true
+  # 是否开启设计器ui
+  ui: true
+  # 默认Authorization，如果有多个token，用逗号分隔
   token-name: ${sa-token.token-name},clientid
diff --git a/ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/handler/WorkflowPermissionHandler.java b/ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/handler/WorkflowPermissionHandler.java
index 3ce655a4b..4c8ccd334 100644
--- a/ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/handler/WorkflowPermissionHandler.java
+++ b/ruoyi-modules/ruoyi-workflow/src/main/java/org/dromara/workflow/handler/WorkflowPermissionHandler.java
@@ -1,5 +1,6 @@
 package org.dromara.workflow.handler;
 
+import cn.hutool.core.util.ObjectUtil;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.dromara.common.core.domain.model.LoginUser;
@@ -10,6 +11,7 @@ import org.dromara.warm.flow.core.handler.PermissionHandler;
 import org.dromara.warm.flow.core.service.impl.TaskServiceImpl;
 import org.springframework.stereotype.Component;
 
+import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 import java.util.stream.Collectors;
@@ -33,6 +35,9 @@ public class WorkflowPermissionHandler implements PermissionHandler {
     @Override
     public List<String> permissions() {
         LoginUser loginUser = LoginHelper.getLoginUser();
+        if (ObjectUtil.isNull(loginUser)) {
+            return new ArrayList<>();
+        }
         // 使用一个流来构建权限列表
         return Stream.of(
                 // 角色权限前缀