diff --git a/WebApi/Controllers/BudgetController.cs b/WebApi/Controllers/BudgetController.cs
index 80ee5d4..b81507c 100644
--- a/WebApi/Controllers/BudgetController.cs
+++ b/WebApi/Controllers/BudgetController.cs
@@ -19,7 +19,7 @@ public class BudgetController(
                 .OrderBy(b => b.IsStopped)
                 .OrderBy(b => b.Category)
                 .ThenBy(b => b.Type)
-                .ThenByDescending(b => b.Current / b.Limit)
+                .ThenByDescending(b => b.Limit > 0 ? b.Current / b.Limit : 0)
                 .ThenBy(b => b.Name)
                 .ToList()
                 .Ok();
diff --git a/WebApi/Program.cs b/WebApi/Program.cs
index 17f336d..e3a874f 100644
--- a/WebApi/Program.cs
+++ b/WebApi/Program.cs
@@ -1,6 +1,7 @@
-using System.Text.Json.Serialization;
 using FreeSql;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc.Authorization;
 using Microsoft.IdentityModel.Tokens;
 using Scalar.AspNetCore;
 using Serilog;
@@ -21,7 +22,14 @@ builder.Host.UseSerilog((context, loggerConfig) =>
 });
 
 // Add services to the container.
-builder.Services.AddControllers();
+builder.Services.AddControllers(options =>
+{
+    var policy = new AuthorizationPolicyBuilder(JwtBearerDefaults.AuthenticationScheme)
+        .RequireAuthenticatedUser()
+        .Build();
+
+    options.Filters.Add(new AuthorizeFilter(policy));
+});
 builder.Services.AddOpenApi();
 builder.Services.AddHttpClient();
 
@@ -65,6 +73,21 @@ builder.Services.AddAuthentication(options =>
         IssuerSigningKey = new SymmetricSecurityKey(key),
         ClockSkew = TimeSpan.Zero
     };
+    options.Events = new JwtBearerEvents
+    {
+        OnChallenge = async context =>
+        {
+            context.Response.StatusCode = StatusCodes.Status401Unauthorized;
+            context.Response.ContentType = "application/json";
+            await context.Response.WriteAsJsonAsync(BaseResponse.Fail("未登录"));
+        },
+        OnForbidden = async context =>
+        {
+            context.Response.StatusCode = StatusCodes.Status403Forbidden;
+            context.Response.ContentType = "application/json";
+            await context.Response.WriteAsJsonAsync(BaseResponse.Fail("权限不足"));
+        }
+    };
 });
 
 builder.Services.AddAuthorization();