diff --git a/src/main/java/com/yau/digitalrmb/security/config/SecurityConfig.java b/src/main/java/com/yau/digitalrmb/security/config/SecurityConfig.java
index 99640ce..d21e398 100644
--- a/src/main/java/com/yau/digitalrmb/security/config/SecurityConfig.java
+++ b/src/main/java/com/yau/digitalrmb/security/config/SecurityConfig.java
@@ -68,10 +68,12 @@ public class SecurityConfig {
     private static void writeError(javax.servlet.http.HttpServletResponse response, ErrorCode code, int status)
             throws java.io.IOException {
         response.setStatus(status);
+        response.setCharacterEncoding(StandardCharsets.UTF_8.name());
         response.setContentType(MediaType.APPLICATION_JSON_VALUE);
         String traceId = response.getHeader(TraceIdFilter.HEADER_NAME);
         if (traceId == null) traceId = UUID.randomUUID().toString();
-        response.getWriter().write("{\"code\":\"" + code.name() + "\",\"message\":\"" + code.name()
+        String message = code == ErrorCode.UNAUTHORIZED ? "未登录或登录已失效" : "无访问权限";
+        response.getWriter().write("{\"code\":\"" + code.name() + "\",\"message\":\"" + message
                 + "\",\"data\":null,\"traceId\":\"" + traceId + "\"}");
     }
 }
diff --git a/src/main/java/com/yau/digitalrmb/shared/api/ApiResponse.java b/src/main/java/com/yau/digitalrmb/shared/api/ApiResponse.java
index 601c611..01da6c5 100644
--- a/src/main/java/com/yau/digitalrmb/shared/api/ApiResponse.java
+++ b/src/main/java/com/yau/digitalrmb/shared/api/ApiResponse.java
@@ -24,6 +24,6 @@ public class ApiResponse<T> {
     public T data() { return data; }
     public String traceId() { return traceId; }
     public Instant timestamp() { return timestamp; }
-    public static <T> ApiResponse<T> success(T data, String traceId) { return new ApiResponse<T>(ErrorCode.SUCCESS.name(), "success", data, traceId, Instant.now()); }
+    public static <T> ApiResponse<T> success(T data, String traceId) { return new ApiResponse<T>(ErrorCode.SUCCESS.name(), "操作成功", data, traceId, Instant.now()); }
     public static <T> ApiResponse<T> failure(ErrorCode errorCode, String message, String traceId) { return new ApiResponse<T>(errorCode.name(), message, null, traceId, Instant.now()); }
 }
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index 85c016c..2fb40e5 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -1,6 +1,13 @@
 spring:
   profiles:
     active: dev
+
+server:
+  servlet:
+    encoding:
+      charset: UTF-8
+      enabled: true
+      force: true
   application:
     name: digital-rmb-backend
   datasource:
diff --git a/src/test/java/com/yau/digitalrmb/security/SecurityConfigTest.java b/src/test/java/com/yau/digitalrmb/security/SecurityConfigTest.java
new file mode 100644
index 0000000..200f75b
--- /dev/null
+++ b/src/test/java/com/yau/digitalrmb/security/SecurityConfigTest.java
@@ -0,0 +1,33 @@
+package com.yau.digitalrmb.security;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.http.MediaType;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.web.servlet.MockMvc;
+
+import java.nio.charset.StandardCharsets;
+
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+@SpringBootTest
+@AutoConfigureMockMvc
+@ActiveProfiles("test")
+class SecurityConfigTest {
+    @Autowired
+    private MockMvc mockMvc;
+
+    @Test
+    void returnsChineseUtf8MessageWhenAuthenticationIsMissing() throws Exception {
+        mockMvc.perform(get("/api/v1/commercial-banks/issuance/inventory"))
+                .andExpect(status().isUnauthorized())
+                .andExpect(content().contentTypeCompatibleWith(MediaType.APPLICATION_JSON))
+                .andExpect(content().encoding(StandardCharsets.UTF_8))
+                .andExpect(jsonPath("$.message").value("未登录或登录已失效"));
+    }
+}