diff --git a/src/test/resources/application.yml b/src/test/resources/application.yml
index 9a00708..e6aafe0 100644
--- a/src/test/resources/application.yml
+++ b/src/test/resources/application.yml
@@ -16,6 +16,13 @@ mybatis-plus:
     configuration:
         log-impl: org.apache.ibatis.logging.nologging.NoLoggingImpl
 
+# 测试环境不激活 profile，而 src/test/resources/application.yml 会遮蔽 src/main/resources/application.yml，
+# 因此这里必须显式声明 cors 配置，否则 WebMvcConfig 会因 allowedOrigins 为 null 抛 NPE
+cors:
+    allowCredentials: true
+    allowed-origins:
+        - '*'
+
 sa-token:
     token-name: satoken
     timeout: 2592000