diff --git a/lib/note/index.js b/lib/note/index.js
index be18bc4f..b9b7c9e3 100644
--- a/lib/note/index.js
+++ b/lib/note/index.js
@@ -61,6 +61,8 @@ async function showNote (req, res) {
     // if allow free url enable, auto create note
     if (!config.allowFreeURL || config.forbiddenNoteIDs.includes(noteId)) {
       return errorNotFound(req, res)
+    } else if (!config.allowAnonymous && !userId) {
+      return errorForbidden(req, res)
     }
     note = await createNote(userId, noteId)
   }