diff --git a/manager/backend/pkg/plugin/permission/plugin.go b/manager/backend/pkg/plugin/permission/plugin.go
index 33bffbdee6102f68d310c76ee41eaaa58e434bc6..1755024d12cced5ce9754c57cab21f583494cd66 100644
--- a/manager/backend/pkg/plugin/permission/plugin.go
+++ b/manager/backend/pkg/plugin/permission/plugin.go
@@ -160,6 +160,10 @@ func (c *Config) GetJWTSecret() (conf JWTConfig, err error) {
 		err = fmt.Errorf("get jwt secret failed,%s", err.Error())
 		return
 	}
+	if resp == nil {
+		err = fmt.Errorf("get jwt secret failed, empty response")
+		return
+	}
 	c.JWTSecret = []byte(resp.Secret)
 	c.JWTHeadKey = resp.HeadKey
 	return c.JWTConfig, nil
diff --git a/manager/backend/pkg/plugin/permission/plugin_test.go b/manager/backend/pkg/plugin/permission/plugin_test.go
index d62347159d2e0d67c99b693fe93a805bced3f65f..5b79f34b6fa42a2cf0bd5715483eac3265744985 100644
--- a/manager/backend/pkg/plugin/permission/plugin_test.go
+++ b/manager/backend/pkg/plugin/permission/plugin_test.go
@@ -3,9 +3,13 @@ package permission
 import (
 	"fmt"
 	"runtime/debug"
+	"strings"
 	"testing"
 
 	"github.com/go-playground/assert/v2"
+	"github.com/golang/mock/gomock"
+	ftpb "gitee.com/OpenCloudOS/ocmanager/manager/backend/protocol/footstone"
+	"google.golang.org/protobuf/types/known/emptypb"
 	yaml "gopkg.in/yaml.v3"
 	"trpc.group/trpc-go/trpc-go"
 )
@@ -56,3 +60,22 @@ func TestTMPlugin_Setup(t *testing.T) {
 func TestServerFilter(t *testing.T) {
 	t.Skip("legacy filter integration test; see plugin.go filter.Register")
 }
+
+func TestConfigGetJWTSecretNilResponse(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	auth := ftpb.NewMockUserClientProxy(ctrl)
+	auth.EXPECT().
+		QueryJWTSecret(gomock.Any(), &emptypb.Empty{}).
+		Return(nil, nil)
+
+	cfg := Config{AuthService: auth}
+	_, err := cfg.GetJWTSecret()
+	if err == nil {
+		t.Fatal("expected error for nil QueryJWTSecret response")
+	}
+	if !strings.Contains(err.Error(), "empty response") {
+		t.Fatalf("expected empty response error, got %v", err)
+	}
+}