diff --git a/encipher/aes.go b/encipher/aes.go
index e8ff8f5..de87055 100644
--- a/encipher/aes.go
+++ b/encipher/aes.go
@@ -28,6 +28,9 @@ func New() {
 }
 
 func GenerateTokenAes(id uint, identity, client, role string, extend map[string]string) (string, error) {
+	if (JwtSecretLen == 16 || JwtSecretLen == 24 || JwtSecretLen == 32) == false {
+		return "", errors.New("JwtSecret lenght must 16/24/32.")
+	}
 	expireTime := time.Now().Add(vars.JwtExpireDay)
 	claims := types.JwtClaims{
 		ID:        id,
@@ -51,9 +54,7 @@ func GenerateTokenAes(id uint, identity, client, role string, extend map[string]
 }
 
 func AesEncryptCBC(plan []byte) (string, error) {
-	if (JwtSecretLen == 16 || JwtSecretLen == 24 || JwtSecretLen == 32) == false {
-		return "", errors.New("JwtSecret lenght must 16/24/32.")
-	}
+
 	// 分组秘钥
 	// NewCipher该函数限制了输入k的长度必须为16, 24或者32
 	block, _ := aes.NewCipher(JwtSecret)
@@ -121,6 +122,10 @@ func PKCS7UnPadding(origData []byte, blocksize int) []byte {
 
 	length := len(origData)
 	unpadding := int(origData[length-1])
+
+	if length-unpadding <= 0 {
+		return nil
+	}
 	return origData[:(length - unpadding)]
 }