diff --git a/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/AuthenticationHolder.java b/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/AuthenticationHolder.java
index d782b6b52..d9c254eee 100644
--- a/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/AuthenticationHolder.java
+++ b/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/AuthenticationHolder.java
@@ -51,12 +51,16 @@ public final class AuthenticationHolder {
     private static final ReadWriteLock lock = new ReentrantReadWriteLock();
 
     private static Optional<Authentication> get(Function<AuthenticationSupplier, Optional<Authentication>> function) {
-        if (suppliers.size() == 1) {
+        int size = suppliers.size();
+        if (size == 0) {
+            return Optional.empty();
+        }
+        if (size == 1) {
             return suppliers.get(0).get();
         }
         SimpleAuthentication merge = new SimpleAuthentication();
         for (AuthenticationSupplier supplier : suppliers) {
-            supplier.get().ifPresent(merge::merge);
+            function.apply(supplier).ifPresent(merge::merge);
         }
         if (merge.getUser() == null) {
             return Optional.empty();