diff --git a/app.js b/app.js
index ed8e52f..2086ef7 100644
--- a/app.js
+++ b/app.js
@@ -61,6 +61,8 @@ global.syzoj = {
     let multer = require('multer');
     app.multer = multer({ dest: syzoj.utils.resolvePath(syzoj.config.upload_dir, 'tmp') });
 
+    // This should before load api_v2, to init the `res.locals.user`
+    this.loadHooks();
     // Trick to bypass CSRF for APIv2
     app.use((() => {
       let router = new Express.Router();
@@ -73,7 +75,6 @@ global.syzoj = {
     app.use(csurf({ cookie: true }));
 
     await this.connectDatabase();
-    this.loadHooks();
     this.loadModules();
   },
   async connectDatabase() {