diff --git a/src/main/kotlin/com/android/trisolarisserver/security/FirebaseAuthFilter.kt b/src/main/kotlin/com/android/trisolarisserver/security/FirebaseAuthFilter.kt
index 6553e83..bf8dd1a 100644
--- a/src/main/kotlin/com/android/trisolarisserver/security/FirebaseAuthFilter.kt
+++ b/src/main/kotlin/com/android/trisolarisserver/security/FirebaseAuthFilter.kt
@@ -62,7 +62,15 @@ class FirebaseAuthFilter(
             val auth = UsernamePasswordAuthenticationToken(principal, token, emptyList())
             SecurityContextHolder.getContext().authentication = auth
             setDebug("ok:userId=${principal.userId},superAdmin=${user.superAdmin}")
-            filterChain.doFilter(request, response)
+            try {
+                filterChain.doFilter(request, response)
+            } catch (ex: Exception) {
+                if (debug) {
+                    val msg = ex.message?.take(200) ?: ""
+                    response.setHeader("X-Downstream-Exception", "${ex::class.java.simpleName}:$msg")
+                }
+                throw ex
+            }
         } catch (ex: Exception) {
             logger.debug("Auth failed for {}: {}", request.requestURI, ex.message)
             setDebug("verify_failed")