diff --git a/config/views/miniapp_config.py b/config/views/miniapp_config.py
index e1b7a92..e31a194 100644
--- a/config/views/miniapp_config.py
+++ b/config/views/miniapp_config.py
@@ -61,7 +61,6 @@ import logging
 logger = logging.getLogger(__name__)
 
 class GetDynamicConfigView(APIView):
-    authentication_classes = ()
     permission_classes = [AllowAny]
     parser_classes = [JSONParser]
 
diff --git a/jituan/views.py b/jituan/views.py
index cade5a6..362e087 100644
--- a/jituan/views.py
+++ b/jituan/views.py
@@ -48,18 +48,9 @@ class ClubWechatLoginView(APIView):
     多俱乐部微信小程序登录（新接口，旧 /yonghu/wechatlogin 不变）。
     POST /jituan/auth/wechat-login
     body: { code, club_id?, app_id? }
-
-    注意：必须完全跳过 JWT/权限/限流。
-    DRF 在 authentication_classes=[] 时若仍抛 AuthenticationFailed，
-    会因无 WWW-Authenticate 头被改写成 HTTP 403（前端显示「权限不足」）。
     """
-    authentication_classes = ()
-    permission_classes = ()
-    throttle_classes = ()
-
-    def initial(self, request, *args, **kwargs):
-        # 登录接口不做任何鉴权/权限/限流，避免 403「权限不足」
-        return
+    throttle_classes = [AnonRateThrottle]
+    permission_classes = [AllowAny]
 
     def post(self, request):
         code = (request.data.get('code') or '').strip()
@@ -123,12 +114,8 @@ class ClubKefuLoginView(APIView):
     POST /jituan/auth/kefu-login
     body: { phone, password, erjimima }
     """
-    authentication_classes = ()
-    permission_classes = ()
-    throttle_classes = ()
-
-    def initial(self, request, *args, **kwargs):
-        return
+    throttle_classes = [AnonRateThrottle]
+    permission_classes = [AllowAny]
 
     def post(self, request):
         phone = (request.data.get('phone') or '').strip()
diff --git a/users/views/auth.py b/users/views/auth.py
index 37566a8..1adf3b9 100644
--- a/users/views/auth.py
+++ b/users/views/auth.py
@@ -103,13 +103,8 @@ class WechatMiniProgramLoginView(APIView):
     """
     微信小程序登录接口
     """
-    authentication_classes = ()
-    permission_classes = ()
-    throttle_classes = ()
-
-    def initial(self, request, *args, **kwargs):
-        # 与 /jituan/auth/wechat-login 一致：登录绝不走 JWT，避免 403「权限不足」
-        return
+    throttle_classes = [AnonRateThrottle]
+    permission_classes = [AllowAny]
 
     def post(self, request):
         try: