diff --git a/hope-winery/src/main/java/com/ruoyi/winery/controller/AppOrderController.java b/hope-winery/src/main/java/com/ruoyi/winery/controller/AppOrderController.java
index 4f75dd5c4..e56cd44c0 100644
--- a/hope-winery/src/main/java/com/ruoyi/winery/controller/AppOrderController.java
+++ b/hope-winery/src/main/java/com/ruoyi/winery/controller/AppOrderController.java
@@ -222,7 +222,7 @@ public class AppOrderController extends BaseController {
     }
 
     @Log(title = "回调", businessType = BusinessType.OTHER)
-    @PostMapping("/payNotify")
+    @PostMapping("/pay/payNotify")
     String payNotify(@RequestBody String xmlData) throws WxPayException {
         WxPayOrderNotifyResult notifyResult = wxPayService.parseOrderNotifyResult(xmlData);
         // TODO 根据自己业务场景需要构造返回对象
diff --git a/ruoyi-admin/src/main/resources/application.yml b/ruoyi-admin/src/main/resources/application.yml
index 570a58ff1..afd9466e5 100644
--- a/ruoyi-admin/src/main/resources/application.yml
+++ b/ruoyi-admin/src/main/resources/application.yml
@@ -197,7 +197,7 @@ wxmini:
   appId: wx76ec015fc31a1946 #微信公众号或者小程序等的appid 必填
   mchId: 1486984962
   mchKey: 82aZ9Tb6eu5W2HdXKQWZU2SztU8w8nJ8
-  notifyUrl: http://41.liyiren.me:8696/winery/order/payNotify
+  notifyUrl: http://41.liyiren.me:8696/winery/order/pay/payNotify
   subAppId: #服务商模式下的子商户公众账号ID
   subMchId: #服务商模式下的子商户号
   tradeType: JSAPI  #交易类型
diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
index 6df85264a..8bfcdea26 100644
--- a/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
+++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/config/SecurityConfig.java
@@ -115,6 +115,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter
                 .antMatchers("/*/api-docs").anonymous()
                 .antMatchers("/druid/**").anonymous()
                 .antMatchers("/winery/mini/user/**").permitAll()
+                .antMatchers("/winery/order/pay/**").permitAll()
                 // 除上面外的所有请求全部需要鉴权认证
                 .anyRequest().authenticated()
                 .and()