diff --git a/api/src/main/java/com/databasir/api/IndexController.java b/api/src/main/java/com/databasir/api/IndexController.java
index 20f3312..8e2639e 100644
--- a/api/src/main/java/com/databasir/api/IndexController.java
+++ b/api/src/main/java/com/databasir/api/IndexController.java
@@ -1,7 +1,9 @@
 package com.databasir.api;
 
+import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ResponseStatus;
 
 @Controller
 public class IndexController {
@@ -11,4 +13,8 @@ public class IndexController {
         return "index.html";
     }
 
+    @ResponseStatus(HttpStatus.NOT_FOUND)
+    public String handleResourceNotFoundException() {
+        return "/index.html";
+    }
 }
diff --git a/api/src/main/java/com/databasir/api/config/SecurityConfig.java b/api/src/main/java/com/databasir/api/config/SecurityConfig.java
index 7eb3d2d..04b092e 100644
--- a/api/src/main/java/com/databasir/api/config/SecurityConfig.java
+++ b/api/src/main/java/com/databasir/api/config/SecurityConfig.java
@@ -45,7 +45,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
                 .and()
                 .authorizeRequests()
                 .antMatchers("/login", Routes.Login.REFRESH_ACCESS_TOKEN).permitAll()
-                .antMatchers("/oauth2/apps", "/oauth2/failure", "/oauth2/authorization/*", "/oauth2/login/*")
+                .antMatchers("/oauth2/apps", "/oauth2/failure", "/oauth2/authorization/*",
+                        "/oauth2/login/*", "/login/oauth2/*")
                 .permitAll()
                 .antMatchers("/", "/*.html", "/js/**", "/css/**", "/img/**", "/*.ico").permitAll()
                 .anyRequest().authenticated()
diff --git a/api/src/main/java/com/databasir/api/config/WebConfig.java b/api/src/main/java/com/databasir/api/config/WebConfig.java
index c903d15..0e102c9 100644
--- a/api/src/main/java/com/databasir/api/config/WebConfig.java
+++ b/api/src/main/java/com/databasir/api/config/WebConfig.java
@@ -3,10 +3,15 @@ package com.databasir.api.config;
 import com.fasterxml.jackson.datatype.jsr310.deser.LocalDateTimeDeserializer;
 import com.fasterxml.jackson.datatype.jsr310.ser.LocalDateTimeSerializer;
 import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
+import org.springframework.boot.web.server.ErrorPage;
+import org.springframework.boot.web.server.WebServerFactoryCustomizer;
+import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.data.web.config.EnableSpringDataWebSupport;
+import org.springframework.http.HttpStatus;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
+import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
 
 import java.time.format.DateTimeFormatter;
@@ -22,6 +27,16 @@ public class WebConfig extends WebMvcConfigurerAdapter {
                 .allowedMethods("GET", "POST", "DELETE", "PATCH", "PUT");
     }
 
+    @Override
+    public void addViewControllers(ViewControllerRegistry registry) {
+        registry.addViewController("/notFound").setViewName("forward:/index.html");
+    }
+
+    @Bean
+    public WebServerFactoryCustomizer<ConfigurableServletWebServerFactory> containerCustomizer() {
+        return container -> container.addErrorPages(new ErrorPage(HttpStatus.NOT_FOUND, "/notFound"));
+    }
+
     @Bean
     public Jackson2ObjectMapperBuilderCustomizer jsonCustomizer() {
         final String dateTimeFormat = "yyyy-MM-dd HH:mm:ss";
diff --git a/core/src/main/java/com/databasir/core/domain/app/handler/GithubOpenAuthHandler.java b/core/src/main/java/com/databasir/core/domain/app/handler/GithubOpenAuthHandler.java
index 8141bfd..54d4b8e 100644
--- a/core/src/main/java/com/databasir/core/domain/app/handler/GithubOpenAuthHandler.java
+++ b/core/src/main/java/com/databasir/core/domain/app/handler/GithubOpenAuthHandler.java
@@ -43,10 +43,10 @@ public class GithubOpenAuthHandler implements OpenAuthHandler {
     public OAuthProcessResult process(OauthAppPojo app, Map<String, String[]> requestParams) {
         String clientId = app.getClientId();
         String clientSecret = app.getClientSecret();
-        String baseUrl = app.getResourceUrl();
+        String authUrl = app.getAuthUrl();
 
         String code = requestParams.get("code")[0];
-        JsonNode tokenNode = githubRemoteService.getToken(baseUrl, clientId, clientSecret, code)
+        JsonNode tokenNode = githubRemoteService.getToken(authUrl, clientId, clientSecret, code)
                 .get("access_token");
         if (tokenNode == null) {
             throw new DatabasirAuthenticationException(DomainErrors.NETWORK_ERROR.exception());
@@ -55,8 +55,9 @@ public class GithubOpenAuthHandler implements OpenAuthHandler {
         if (StringUtils.isBlank(accessToken)) {
             throw new CredentialsExpiredException("授权失效，请重新登陆");
         }
+        String resourceUrl = app.getResourceUrl();
         String email = null;
-        for (JsonNode node : githubRemoteService.getEmail(baseUrl, accessToken)) {
+        for (JsonNode node : githubRemoteService.getEmail(resourceUrl, accessToken)) {
             if (node.get("primary").asBoolean()) {
                 email = node.get("email").asText();
             }
@@ -64,7 +65,7 @@ public class GithubOpenAuthHandler implements OpenAuthHandler {
         if (StringUtils.isBlank(email)) {
             throw new CredentialsExpiredException("授权失效，请重新登陆");
         }
-        JsonNode profile = githubRemoteService.getProfile(baseUrl, accessToken);
+        JsonNode profile = githubRemoteService.getProfile(resourceUrl, accessToken);
         String nickname = profile.get("name").asText();
         String avatar = profile.get("avatar_url").asText();
         OAuthProcessResult result = new OAuthProcessResult();
diff --git a/core/src/main/java/com/databasir/core/domain/app/handler/GitlabOpenAuthHandler.java b/core/src/main/java/com/databasir/core/domain/app/handler/GitlabOpenAuthHandler.java
index d80a2e7..7155369 100644
--- a/core/src/main/java/com/databasir/core/domain/app/handler/GitlabOpenAuthHandler.java
+++ b/core/src/main/java/com/databasir/core/domain/app/handler/GitlabOpenAuthHandler.java
@@ -37,6 +37,7 @@ public class GitlabOpenAuthHandler implements OpenAuthHandler {
                 .queryParam("redirect_uri", redirectUri)
                 .queryParam("response_type", "code")
                 .queryParam("state", redirectUri)
+                .queryParam("scope", "read_user")
                 .encode()
                 .build()
                 .toUriString();