diff --git a/fine-socketio/src/main/java/com/fr/third/socketio/Configuration.java b/fine-socketio/src/main/java/com/fr/third/socketio/Configuration.java
index 78d1f8463..4f3bea8fb 100644
--- a/fine-socketio/src/main/java/com/fr/third/socketio/Configuration.java
+++ b/fine-socketio/src/main/java/com/fr/third/socketio/Configuration.java
@@ -89,6 +89,8 @@ public class Configuration {
 
     private boolean randomSession = false;
 
+    private String accessControlAllowHeaders = null;
+
     public Configuration() {
     }
 
@@ -155,6 +157,8 @@ public class Configuration {
         setHttpCompression(conf.isHttpCompression());
         setWebsocketCompression(conf.isWebsocketCompression());
         setRandomSession(conf.randomSession);
+
+        setAccessControlAllowHeaders(conf.getAccessControlAllowHeaders());
     }
 
     public JsonSupport getJsonSupport() {
@@ -584,4 +588,12 @@ public class Configuration {
     public void setRandomSession(boolean randomSession) {
         this.randomSession = randomSession;
     }
+
+    public String getAccessControlAllowHeaders() {
+        return accessControlAllowHeaders;
+    }
+
+    public void setAccessControlAllowHeaders(String accessControlAllowHeaders) {
+        this.accessControlAllowHeaders = accessControlAllowHeaders;
+    }
 }
diff --git a/fine-socketio/src/main/java/com/fr/third/socketio/handler/EncoderHandler.java b/fine-socketio/src/main/java/com/fr/third/socketio/handler/EncoderHandler.java
index 3752427f4..cd7a93b51 100644
--- a/fine-socketio/src/main/java/com/fr/third/socketio/handler/EncoderHandler.java
+++ b/fine-socketio/src/main/java/com/fr/third/socketio/handler/EncoderHandler.java
@@ -15,6 +15,7 @@
  */
 package com.fr.third.socketio.handler;
 
+import static com.fr.third.springframework.util.StringUtils.isEmpty;
 import static io.netty.handler.codec.http.HttpVersion.HTTP_1_1;
 
 import java.io.IOException;
@@ -121,7 +122,7 @@ public class EncoderHandler extends ChannelOutboundHandlerAdapter {
                     .add(HttpHeaderNames.ACCESS_CONTROL_ALLOW_HEADERS, HttpHeaderNames.CONTENT_TYPE);
 
         String origin = ctx.channel().attr(ORIGIN).get();
-        addOriginHeaders(origin, res);
+        addOriginAndAllowHeaders(origin, res);
 
         ByteBuf out = encoder.allocateBuffer(ctx.alloc());
         sendMessage(msg, ctx.channel(), out, res, promise);
@@ -143,7 +144,7 @@ public class EncoderHandler extends ChannelOutboundHandlerAdapter {
         }
 
         String origin = channel.attr(ORIGIN).get();
-        addOriginHeaders(origin, res);
+        addOriginAndAllowHeaders(origin, res);
 
         HttpUtil.setContentLength(res, out.readableBytes());
 
@@ -185,10 +186,7 @@ public class EncoderHandler extends ChannelOutboundHandlerAdapter {
         sendMessage(errorMsg, ctx.channel(), encBuf, "application/json", promise, HttpResponseStatus.BAD_REQUEST);
     }
 
-    private void addOriginHeaders(String origin, HttpResponse res) {
-
-        // 使WebSocket连接时可添加fine_username和fine_auth_token的Header
-        res.headers().add(HttpHeaderNames.ACCESS_CONTROL_ALLOW_HEADERS, "fine_username,fine_auth_token");
+    private void addOriginAndAllowHeaders(String origin, HttpResponse res) {
 
         if (version != null) {
             res.headers().add(HttpHeaderNames.SERVER, version);
@@ -196,12 +194,17 @@ public class EncoderHandler extends ChannelOutboundHandlerAdapter {
 
         if (origin != null) {
             String configOrigin = configuration.getOrigin();
-            if (configOrigin != null && !"".equals(configOrigin) && !configOrigin.contains(origin)) {
+            if (!isEmpty(configOrigin) && !configOrigin.contains(origin)) {
                 throw new IllegalArgumentException();
             }
             res.headers().add(HttpHeaderNames.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
             res.headers().add(HttpHeaderNames.ACCESS_CONTROL_ALLOW_CREDENTIALS, Boolean.TRUE);
         }
+
+        String allowHeaders = configuration.getAccessControlAllowHeaders();
+        if (!isEmpty(allowHeaders)) {
+            res.headers().add(HttpHeaderNames.ACCESS_CONTROL_ALLOW_HEADERS, configuration.getAccessControlAllowHeaders());
+        }
     }
 
     @Override