diff --git a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java
index 3a9f1a862..626624b7d 100644
--- a/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java
+++ b/pigx-common/pigx-common-security/src/main/java/com/pig4cloud/pigx/common/security/component/PigxUserAuthenticationConverter.java
@@ -20,11 +20,13 @@ package com.pig4cloud.pigx.common.security.component;
 import cn.hutool.core.util.StrUtil;
 import com.pig4cloud.pigx.common.core.constant.CommonConstants;
 import com.pig4cloud.pigx.common.core.constant.SecurityConstants;
-import com.pig4cloud.pigx.common.security.exception.ForbiddenException;
+import com.pig4cloud.pigx.common.security.exception.PigxAuth2Exception;
 import com.pig4cloud.pigx.common.security.service.PigxUser;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.oauth2.provider.token.UserAuthenticationConverter;
 import org.springframework.util.StringUtils;
@@ -32,10 +34,7 @@ import org.springframework.web.context.request.RequestContextHolder;
 import org.springframework.web.context.request.ServletRequestAttributes;
 
 import javax.servlet.http.HttpServletRequest;
-import java.util.Collection;
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.Optional;
+import java.util.*;
 
 /**
  * @author lengleng
@@ -43,6 +42,7 @@ import java.util.Optional;
  * <p>
  * 根据checktoken 的结果转化用户信息
  */
+@Slf4j
 public class PigxUserAuthenticationConverter implements UserAuthenticationConverter {
 	private static final String N_A = "N/A";
 
@@ -100,18 +100,20 @@ public class PigxUserAuthenticationConverter implements UserAuthenticationConver
 		String headerValue =  getCurrentTenantId();
 		Integer userValue = (Integer) map.get(SecurityConstants.DETAILS_TENANT_ID);
 		if(StrUtil.isNotBlank(headerValue) && !userValue.toString().equals(headerValue)){
-			// TODO: 不要提示租户ID不对，避免被穷举
-			throw new ForbiddenException("bad tenant id");
+			log.warn("请求头中的租户ID({})和用户的租户ID({})不一致",headerValue,userValue);
+			// TODO: 不要提示租户ID不对，可能被穷举
+			throw new PigxAuth2Exception(SpringSecurityMessageSource.getAccessor().getMessage("AbstractUserDetailsAuthenticationProvider.badTenantId","Bad tenant ID"));
 		}
 	}
 
-	public static Optional<HttpServletRequest> getCurrentHttpRequest() {
+	private Optional<HttpServletRequest> getCurrentHttpRequest() {
 		return Optional.ofNullable(RequestContextHolder.getRequestAttributes())
 				.filter(requestAttributes -> ServletRequestAttributes.class.isAssignableFrom(requestAttributes.getClass()))
 				.map(requestAttributes -> ((ServletRequestAttributes) requestAttributes))
 				.map(ServletRequestAttributes::getRequest);
 	}
-	public static String getCurrentTenantId() {
+
+	private String getCurrentTenantId() {
 		return getCurrentHttpRequest().map(httpServletRequest -> httpServletRequest.getHeader(CommonConstants.TENANT_ID)).orElse(null);
 	}
 }
diff --git a/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties b/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties
index af3326c35..86d66087f 100644
--- a/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties
+++ b/pigx-common/pigx-common-security/src/main/resources/org/springframework/security/messages_zh_CN.properties
@@ -24,6 +24,7 @@ AbstractUserDetailsAuthenticationProvider.disabled=\u7528\u6237\u672A\u6FC0\u6D3
 AbstractUserDetailsAuthenticationProvider.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F
 AbstractUserDetailsAuthenticationProvider.locked=\u7528\u6237\u5E10\u53F7\u5DF2\u88AB\u9501\u5B9A
 AbstractUserDetailsAuthenticationProvider.onlySupports=\u4EC5\u4EC5\u652F\u6301UsernamePasswordAuthenticationToken
+AbstractUserDetailsAuthenticationProvider.badTenantId=\u65E0\u6548\u7684TenantId
 AccountStatusUserDetailsChecker.credentialsExpired=\u7528\u6237\u51ED\u8BC1\u5DF2\u8FC7\u671F
 AccountStatusUserDetailsChecker.disabled=\u7528\u6237\u672A\u6FC0\u6D3B
 AccountStatusUserDetailsChecker.expired=\u7528\u6237\u5E10\u53F7\u5DF2\u8FC7\u671F