add

@@ -84,11 +84,7 @@ end
 
   --check is in white ip list
 function is_white()
-  -- we must ignore mthod : app.graphic.img.  this is app toast for user verified
-  local method = http_request.get_method() 
-  if method and method == "app.graphic.img" then
-    return true
-  end
+
 
   if  limit_ip_config then
     local white_ips_length=#limit_ip_config.white_ips
@@ -107,6 +103,13 @@ end
 ----- check weather ip is in black list
 --- be careful when change response(body & header). APP need those to pop up verify toast
 function check_malIp()
+
+   -- we must ignore mthod : app.graphic.img.  this is app toast for user verified
+   local method = http_request.get_method() 
+   if method and ( method == "app.graphic.img" or method == "app.graphic.verify" )then
+     return true
+   end
+
   local cache=lua_context.mal_ip_cache
   local ip=ngx.var.real_ip
   local exist = cache:get("yh:mip:" .. ip)