diff --git a/configs/dev/logging.toml b/configs/dev/logging.toml
index 988a294c..bf0a6016 100644
--- a/configs/dev/logging.toml
+++ b/configs/dev/logging.toml
@@ -1,6 +1,6 @@
 [Logger]
 Debug = true
-Level = "debug"
+Level = "debug" # debug/info/warn/error/dpanic/panic/fatal
 CallerSkip = 1
 
 [Logger.File]
@@ -23,4 +23,4 @@ DSN = "data/ginadmin.db"
 MaxOpenConns = "16"
 MaxIdleConns = "4"
 MaxLifetime = "86400"
-MaxIdleTime = "7200"
\ No newline at end of file
+MaxIdleTime = "7200"
diff --git a/configs/dev/middleware.toml b/configs/dev/middleware.toml
index 8738839e..1f290996 100644
--- a/configs/dev/middleware.toml
+++ b/configs/dev/middleware.toml
@@ -3,20 +3,6 @@
 [Middleware.Recovery]
 Skip = 3
 
-[Middleware.Trace]
-RequestHeaderKey = "X-Request-Id"
-ResponseTraceKey = "X-Trace-Id"
-
-[Middleware.Logger]
-MaxOutputRequestBodyLen = 4096  # bytes
-MaxOutputResponseBodyLen = 1024 # bytes
-
-[Middleware.TokenAuth]
-Enable = true
-
-[Middleware.CopyBody]
-MaxContentLen = 134217728 # 128MB
-
 [Middleware.CORS]
 Enable = false
 AllowOrigins = ["*"]
@@ -27,23 +13,46 @@ AllowWildcard = true
 AllowWebSockets = true
 AllowFiles = true
 
+[Middleware.Trace]
+RequestHeaderKey = "X-Request-Id"
+ResponseTraceKey = "X-Trace-Id"
+
+[Middleware.Logger]
+MaxOutputRequestBodyLen = 4096 # bytes
+MaxOutputResponseBodyLen = 4096 # bytes
+
+[Middleware.CopyBody]
+MaxContentLen = 134217728 # 128MB
+
 [Middleware.Auth]
 Disable = false
 SkippedPathPrefixes = ["/api/v1/captcha/", "/api/v1/login"]
+SigningMethod = "HS512" # HS256/HS384/HS512
+SigningKey = "XnEsT0S@" # Secret key
+OldSigningKey = "" # Old secret key (For change secret key)
+Expired = 86400 # seconds
 
 [Middleware.Auth.Store]
-Type = "badger" # badger/redis
+Type = "badger" # memory/badger/redis
+Delimiter = ":"
+
+[Middleware.Auth.Store.Memory]
+CleanupInterval = 60 # seconds
+
+[Middleware.Auth.Store.Badger]
+Path = "data/auth"
 
 [Middleware.Auth.Store.Redis]
-Addr = ""
+Addr = "" # If empty, then use the same configuration as Storage.Cache.Redis
 Username = ""
 Password = ""
 DB = 2
 
 [Middleware.RateLimiter]
 Enable = false
-MaxRequestsPerIP = 30
-MaxRequestsPerUser = 30
+Period = 10 # seconds
+MaxRequestsPerIP = 1000
+MaxRequestsPerUser = 500
 
 [Middleware.RateLimiter.Store]
 Type = "memory" # memory/redis
@@ -53,7 +62,7 @@ Expiration = 3600
 CleanupInterval = 60
 
 [Middleware.RateLimiter.Store.Redis]
-Addr = ""
+Addr = "" # If empty, then use the same configuration as Storage.Cache.Redis
 Username = ""
 Password = ""
 DB = 10
@@ -61,6 +70,7 @@ DB = 10
 [Middleware.Casbin]
 Disable = false
 SkippedPathPrefixes = ["/api/v1/captcha/", "/api/v1/login", "/api/v1/current/"]
-
-[Middleware.Static]
-SkippedPathPrefixes = ["/api"]
+LoadThread = 2
+AutoLoadInterval = 3 # seconds
+ModelFile = "rbac_model.conf"
+GenPolicyFile = "gen_rbac_policy.csv"
diff --git a/configs/dev/server.toml b/configs/dev/server.toml
index e144084c..a4f14da0 100644
--- a/configs/dev/server.toml
+++ b/configs/dev/server.toml
@@ -1,30 +1,33 @@
 [General]
 AppName = "ginadmin"
-DebugMode = true
-PprofAddr = "localhost:6060"
+Version = "v10.0.2"
+Debug = true
+PprofAddr = "" # Pprof monitor address, "localhost:6060"
 DisableSwagger = false
 DisablePrintConfig = false
-MenuFile = "menu.json"
+DefaultLoginPwd = "6351623c8cef86fefabfa7da046fc619" # MD5("abc-123")
+MenuFile = "menu.json" # Or use "menu_cn.json"
+DenyDeleteMenu = false
 
 [General.HTTP]
 Addr = ":8040"
+ShutdownTimeout = 10
 ReadTimeout = 60
 WriteTimeout = 60
 IdleTimeout = 10
-ShutdownTimeout = 10
 CertFile = ""
 KeyFile = ""
 
-[General.Root]
+[General.Root] # Super Administrator Account
 ID = "root"
 Username = "admin"
-Password = "6351623c8cef86fefabfa7da046fc619" # abc-123
+Password = "6351623c8cef86fefabfa7da046fc619" # MD5("abc-123")
 Name = "Admin"
 
 [Storage]
 
 [Storage.Cache]
-Type = "badger" # badger/redis
+Type = "badger" # memory/badger/redis
 Delimiter = ":"
 
 [Storage.Cache.Memory]
@@ -54,3 +57,30 @@ MaxOpenConns = 100
 MaxIdleConns = 50
 TablePrefix = ""
 AutoMigrate = true
+
+[Util]
+
+[Util.Captcha]
+Length = 4
+Width = 400
+Height = 160
+CacheType = "memory" # memory/redis
+
+[Util.Captcha.Redis]
+Addr = "" # If empty, then use the same configuration as Storage.Cache.Redis
+Username = ""
+Password = ""
+DB = 1
+KeyPrefix = "captcha:"
+
+[Util.Prometheus]
+Enable = false
+Port = 9100
+BasicUsername = "admin"
+BasicPassword = "admin"
+LogApis = [] # Log APIs, e.g. ["/api/v1/users"]
+LogMethods = [] # Log HTTP methods, e.g. ["GET"]
+DefaultCollect = true
+
+[Dictionary]
+UserCacheExp = 4 # hours
diff --git a/internal/config/config.go b/internal/config/config.go
index ed176c83..ae278a66 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -18,17 +18,17 @@ type Config struct {
 
 type General struct {
 	AppName            string `default:"ginadmin"`
-	Version            string `default:"v1.0.0"`
+	Version            string `default:"v10.0.2"`
 	Debug              bool
 	PprofAddr          string
 	DisableSwagger     bool
 	DisablePrintConfig bool
-	DefaultLoginPwd    string `default:"6351623c8cef86fefabfa7da046fc619"` // abc-123
+	DefaultLoginPwd    string `default:"6351623c8cef86fefabfa7da046fc619"` // MD5(abc-123)
 	WorkDir            string // From command arguments
 	MenuFile           string // From schema.Menus (JSON/YAML)
 	DenyDeleteMenu     bool
 	HTTP               struct {
-		Addr            string `default:":8080"`
+		Addr            string `default:":8040"`
 		ShutdownTimeout int    `default:"10"` // seconds
 		ReadTimeout     int    `default:"60"` // seconds
 		WriteTimeout    int    `default:"60"` // seconds
@@ -125,6 +125,12 @@ func (c *Config) PreLoad() {
 	if addr := c.Storage.Cache.Redis.Addr; addr != "" {
 		username := c.Storage.Cache.Redis.Username
 		password := c.Storage.Cache.Redis.Password
+		if c.Util.Captcha.CacheType == "redis" &&
+			c.Util.Captcha.Redis.Addr == "" {
+			c.Util.Captcha.Redis.Addr = addr
+			c.Util.Captcha.Redis.Username = username
+			c.Util.Captcha.Redis.Password = password
+		}
 		if c.Middleware.RateLimiter.Store.Type == "redis" &&
 			c.Middleware.RateLimiter.Store.Redis.Addr == "" {
 			c.Middleware.RateLimiter.Store.Redis.Addr = addr