diff --git a/common-security/src/main/java/com/baiyue/common/security/JwtAuthenticationFilter.java b/common-security/src/main/java/com/baiyue/common/security/JwtAuthenticationFilter.java
index ea503efbf..3ea44844c 100644
--- a/common-security/src/main/java/com/baiyue/common/security/JwtAuthenticationFilter.java
+++ b/common-security/src/main/java/com/baiyue/common/security/JwtAuthenticationFilter.java
@@ -12,6 +12,8 @@ import org.springframework.security.oauth2.jwt.JwtDecoder;
 import org.springframework.security.oauth2.jwt.JwtException;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.web.filter.OncePerRequestFilter;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
 
@@ -19,6 +21,7 @@ import java.io.IOException;
  * Servlet JWT 认证过滤器，解析 Bearer 令牌、校验会话并建立当前请求的安全上下文。
  */
 public class JwtAuthenticationFilter extends OncePerRequestFilter {
+    private static final Logger LOG = LoggerFactory.getLogger(JwtAuthenticationFilter.class);
     private static final String BEARER = "Bearer ";
     private final JwtDecoder jwtDecoder;
     private final JwtClaimsMapper claimsMapper;
@@ -60,6 +63,7 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
             SecurityContextHolder.getContext().setAuthentication(authentication);
             filterChain.doFilter(request, response);
         } catch (JwtException | IllegalArgumentException exception) {
+            LOG.warn("JWT authentication rejected for {}: {}", request.getRequestURI(), exception.getMessage());
             SecurityContextHolder.clearContext();
             authenticationEntryPoint.commence(request, response,
                     new InvalidJwtAuthenticationException("Invalid or expired access token", exception));
diff --git a/common-security/src/test/java/com/baiyue/common/security/JwtAuthenticationFilterTest.java b/common-security/src/test/java/com/baiyue/common/security/JwtAuthenticationFilterTest.java
index 0f0bd77b9..9ea0f4fa1 100644
--- a/common-security/src/test/java/com/baiyue/common/security/JwtAuthenticationFilterTest.java
+++ b/common-security/src/test/java/com/baiyue/common/security/JwtAuthenticationFilterTest.java
@@ -41,4 +41,34 @@ class JwtAuthenticationFilterTest {
         assertThat(invoked).isTrue();
         assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
     }
+
+    @Test
+    void authenticatesMinimalOverseasTokenWithGatewaySnapshot() throws Exception {
+        Jwt jwt = Jwt.withTokenValue("overseas").header("alg", "RS256").subject("42")
+                .issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(60))
+                .claim("tenant_id", 0L).claim("app_code", "PLATFORM")
+                .claim("permission_version", 7L).claim("token_version", 1).build();
+        JwtAuthenticationFilter filter = new JwtAuthenticationFilter(token -> jwt, new JwtClaimsMapper(),
+                new JsonAuthenticationEntryPoint(new ObjectMapper()),
+                new GatewayAccessTokenSessionValidator("gateway-secret"));
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.setRequestURI("/api/platform/v1/last-leg/orders");
+        request.addHeader(HttpHeaders.AUTHORIZATION, "Bearer overseas");
+        request.addHeader(GatewayAccessTokenSessionValidator.TOKEN_HEADER, "gateway-secret");
+        request.addHeader(GatewayAccessTokenSessionValidator.ROLES_HEADER, "PLATFORM_ADMIN");
+        request.addHeader(GatewayAccessTokenSessionValidator.AUTHORITIES_HEADER, "platform:lastleg:view");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        AtomicBoolean invoked = new AtomicBoolean();
+
+        filter.doFilter(request, response, (request1, response1) -> {
+            var authentication = SecurityContextHolder.getContext().getAuthentication();
+            assertThat(authentication).isNotNull();
+            assertThat(authentication.getAuthorities()).extracting("authority")
+                    .contains("APP_PLATFORM", "ROLE_PLATFORM_ADMIN", "platform:lastleg:view");
+            invoked.set(true);
+        });
+
+        assertThat(invoked).isTrue();
+        assertThat(response.getStatus()).isEqualTo(200);
+    }
 }