diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java
index cac995c21..626624b7d 100644
--- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java
+++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java
@@ -17,18 +17,24 @@
 
 package com.pig4cloud.pigx.common.security.component;
 
+import cn.hutool.core.util.StrUtil;
+import com.pig4cloud.pigx.common.core.constant.CommonConstants;
 import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
+import com.pig4cloud.pigx.common.security.exception.PigxAuth2Exception;
 import com.pig4cloud.pigx.common.security.service.PigxUser;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter;
 import org.springframework.util.StringUtils;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
 
-import java.util.Collection;
-import java.util.LinkedHashMap;
-import java.util.Map;
+import javax.servlet.http.HttpServletRequest;
+import java.util.*;
 
 /**
  * @author lengleng
@@ -36,6 +42,7 @@ import java.util.Map;
  * <p>
  * 根据checktoken 的结果转化用户信息
  */
+@Slf4j
 public class PigxUserAuthenticationConverter implements UserAuthenticationConverter {
 	private static final String N_A = "N/A";
 
@@ -64,8 +71,8 @@ public class PigxUserAuthenticationConverter implements UserAuthenticationConver
 	@Override
 	public Authentication extractAuthentication(Map<String, ?> map) {
 		if (map.containsKey(USERNAME)) {
+			validateTenantId(map);
 			Collection<? extends GrantedAuthority> authorities = getAuthorities(map);
-
 			String username = (String) map.get(USERNAME);
 			Integer id = (Integer) map.get(SecurityConstants.DETAILS_USER_ID);
 			Integer deptId = (Integer) map.get(SecurityConstants.DETAILS_DEPT_ID);
@@ -88,4 +95,25 @@ public class PigxUserAuthenticationConverter implements UserAuthenticationConver
 		}
 		throw new IllegalArgumentException("Authorities must be either a String or a Collection");
 	}
+
+	private void validateTenantId(Map<String, ?> map){
+		String headerValue =  getCurrentTenantId();
+		Integer userValue = (Integer) map.get(SecurityConstants.DETAILS_TENANT_ID);
+		if(StrUtil.isNotBlank(headerValue) && !userValue.toString().equals(headerValue)){
+			log.warn("请求头中的租户ID({})和用户的租户ID({})不一致",headerValue,userValue);
+			// TODO: 不要提示租户ID不对，可能被穷举
+			throw new PigxAuth2Exception(SpringSecurityMessageSource.getAccessor().getMessage("AbstractUserDetailsAuthenticationProvider.badTenantId","Bad tenant ID"));
+		}
+	}
+
+	private Optional<HttpServletRequest> getCurrentHttpRequest() {
+		return Optional.ofNullable(RequestContextHolder.getRequestAttributes())
+				.filter(requestAttributes -> ServletRequestAttributes.class.isAssignableFrom(requestAttributes.getClass()))
+				.map(requestAttributes -> ((ServletRequestAttributes) requestAttributes))
+				.map(ServletRequestAttributes::getRequest);
+	}
+
+	private String getCurrentTenantId() {
+		return getCurrentHttpRequest().map(httpServletRequest -> httpServletRequest.getHeader(CommonConstants.TENANT_ID)).orElse(null);
+	}
 }
diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/ForbiddenException.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/ForbiddenException.java
index f9541bb65..9cbe6a55f 100644
--- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/ForbiddenException.java
+++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/ForbiddenException.java
@@ -27,10 +27,12 @@ import org.springframework.http.HttpStatus;
  */
 @JsonSerialize(using = PigxAuth2ExceptionSerializer.class)
 public class ForbiddenException extends PigxAuth2Exception {
-
-	public ForbiddenException(String msg, Throwable t) {
+	public ForbiddenException(String msg) {
 		super(msg);
 	}
+	public ForbiddenException(String msg, Throwable t) {
+		super(msg,t);
+	}
 
 	@Override
 	public String getOAuth2ErrorCode() {
diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/PigxAuth2Exception.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/PigxAuth2Exception.java
index 780f9eb68..bd6b6cd05 100644
--- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/PigxAuth2Exception.java
+++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/exception/PigxAuth2Exception.java
@@ -36,6 +36,10 @@ public class PigxAuth2Exception extends OAuth2Exception {
 		super(msg);
 	}
 
+	public PigxAuth2Exception(String msg, Throwable t) {
+		super(msg,t);
+	}
+
 	public PigxAuth2Exception(String msg, String errorCode) {
 		super(msg);
 		this.errorCode = errorCode;
diff --git a/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties b/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties
index af3326c35..86d66087f 100644
--- a/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties
+++ b/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties
@@ -24,6 +24,7 @@ AbstractUserDetailsAuthenticationProvider.disabled=\u7528\u6237\u672A\u6FC0\u6D3
 AbstractUserDetailsAuthenticationProvider.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F
 AbstractUserDetailsAuthenticationProvider.locked=\u7528\u6237\u5E10\u53F7\u5DF2\u88AB\u9501\u5B9A
 AbstractUserDetailsAuthenticationProvider.onlySupports=\u4EC5\u4EC5\u652F\u6301UsernamePasswordAuthenticationToken
+AbstractUserDetailsAuthenticationProvider.badTenantId=\u65E0\u6548\u7684TenantId
 AccountStatusUserDetailsChecker.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F
 AccountStatusUserDetailsChecker.disabled=\u7528\u6237\u672A\u6FC0\u6D3B
 AccountStatusUserDetailsChecker.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F