common-security/src/main/java/com/baiyue/common/security/GatewayAccessTokenSessionValidator.java

@@ -31,8 +31,13 @@ public final class GatewayAccessTokenSessionValidator implements AccessTokenSess
     @Override
     public AccessTokenSession validate(Jwt jwt, HttpServletRequest request) {
         String supplied = request.getHeader(TOKEN_HEADER);
-        if (supplied == null || !MessageDigest.isEqual(expectedToken, supplied.getBytes(StandardCharsets.UTF_8))) {
-            throw new IllegalArgumentException("Untrusted overseas gateway authorization context");
+        if (supplied == null || supplied.isBlank()) {
+            throw new IllegalArgumentException("Missing overseas gateway authorization context");
+        }
+        byte[] suppliedToken = supplied.getBytes(StandardCharsets.UTF_8);
+        if (!MessageDigest.isEqual(expectedToken, suppliedToken)) {
+            throw new IllegalArgumentException("Invalid overseas gateway authorization context (expectedBytes="
+                    + expectedToken.length + ", suppliedBytes=" + suppliedToken.length + ")");
         }
         Long userId = number(jwt.getClaims().getOrDefault("userId", jwt.getClaims().get("user_id")));
         if (userId == null) {

common-security/src/test/java/com/baiyue/common/security/GatewayAccessTokenSessionValidatorTest.java

@@ -34,7 +34,10 @@ class GatewayAccessTokenSessionValidatorTest {
         forged.addHeader(GatewayAccessTokenSessionValidator.AUTHORITIES_HEADER,
             "platform:overseas-warehouse:last-mile-order:list");
         assertThatThrownBy(() -> validator.validate(jwt(), forged))
-            .isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Untrusted");
+            .isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Invalid overseas gateway");
+
+        assertThatThrownBy(() -> validator.validate(jwt(), new MockHttpServletRequest()))
+            .isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Missing overseas gateway");
     }
 
     private Jwt jwt() {