diff --git a/build.gradle b/build.gradle
index 7361b0b..02893f4 100644
--- a/build.gradle
+++ b/build.gradle
@@ -8,7 +8,7 @@ plugins {
 apply from: '../spotless.gradle'
 
 group = "org.bdware.sc"
-version = "1.9.91"
+version = "1.9.95"
 tasks.withType(JavaCompile) {
     //   options.compilerArgs << '-Xlint:none'
     //   options.compilerArgs << '-Xlint:deprecation' << "-Werror"
@@ -70,8 +70,8 @@ jar {
         //  uncomment this when publish,
         // while develop at local use "false"
         configurations.runtimeClasspath.filter {
-             it.getAbsolutePath().contains("/lib/")
-          //  false
+            it.getAbsolutePath().contains("/lib/")
+            //  false
         }.collect {
             it.isDirectory() ? it : zipTree(it)
         }
diff --git a/src/main/java/org/bdware/sc/engine/hook/AccessHandler.java b/src/main/java/org/bdware/sc/engine/hook/AccessHandler.java
index b4cba6a..cafaadb 100644
--- a/src/main/java/org/bdware/sc/engine/hook/AccessHandler.java
+++ b/src/main/java/org/bdware/sc/engine/hook/AccessHandler.java
@@ -10,6 +10,7 @@ import org.bdware.sc.bean.ContractRequest;
 import org.bdware.sc.boundry.ScriptReturnException;
 import org.bdware.sc.engine.DesktopEngine;
 import org.bdware.sc.engine.JSONTool;
+import org.bdware.sc.entity.DoipMessagePacker;
 import org.bdware.sc.node.AnnotationHook;
 import org.bdware.sc.node.AnnotationNode;
 import org.bdware.sc.node.ArgPacks;
@@ -42,19 +43,17 @@ public class AccessHandler implements AnnotationHook {
     @Override
     public ArgPacks handle(JSEngine desktopEngine, ArgPacks argPacks) {
         if (requireSign) {
-            if (!argPacks.request.verifySignature()) {
+            if (!verifyRequest(argPacks)) {
                 throw new ScriptReturnException(
                         JsonParser.parseString("{\"code\":400,\"msg\":\"permission denied\"}"));
             }
             return argPacks;
         }
-        if (!argPacks.request.verifySignature()) {
+        if (!verifyRequest(argPacks)) {
             LOGGER.info("verify failed! clear requester," + argPacks.request.getContentStr()
                     + " -> " + argPacks.request.getPublicKey() + "sign:"
                     + argPacks.request.getSignature());
-            // TODO
-            // FIXME here!
-            // argPacks.request.setRequester(null);
+            argPacks.request.setRequester(null);
         } else
             LOGGER.info("verify success!" + argPacks.request.getRequester());
         if (acFunction == null)
@@ -78,4 +77,11 @@ public class AccessHandler implements AnnotationHook {
         }
 
     }
+
+    private boolean verifyRequest(ArgPacks argPacks) {
+        if (argPacks.arg != null && argPacks.arg instanceof DoipMessagePacker) {
+            return true;
+        }
+        return argPacks.request.verifySignature();
+    }
 }
diff --git a/src/main/java/org/bdware/sc/handler/DOOPRequestHandler.java b/src/main/java/org/bdware/sc/handler/DOOPRequestHandler.java
index fa4defd..31dc6b3 100644
--- a/src/main/java/org/bdware/sc/handler/DOOPRequestHandler.java
+++ b/src/main/java/org/bdware/sc/handler/DOOPRequestHandler.java
@@ -15,6 +15,7 @@ import org.bdware.doip.endpoint.server.NettyServerHandler;
 import org.bdware.sc.ContractProcess;
 import org.bdware.sc.bean.ContractRequest;
 import org.bdware.sc.boundry.JavaScriptEntry;
+import org.bdware.sc.boundry.ScriptReturnException;
 import org.bdware.sc.crdt.SharableVarManager;
 import org.bdware.sc.entity.DoipMessagePacker;
 import org.bdware.sc.node.FunctionNode;
@@ -22,6 +23,7 @@ import org.bdware.sc.util.JsonUtil;
 
 import java.io.ByteArrayOutputStream;
 import java.io.PrintStream;
+import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -79,6 +81,14 @@ public class DOOPRequestHandler implements DoipRequestHandler {
             finalDoipMsg.header.parameters.attributes.addProperty("nodeID",
                     String.valueOf(JavaScriptEntry.shardingID));
             return finalDoipMsg;
+        } catch (ScriptReturnException e) {
+            DoipMessageFactory.DoipMessageBuilder builder =
+                    new DoipMessageFactory.DoipMessageBuilder();
+            builder.createResponse(DoipResponseCode.Declined, msg);
+            builder.setBody(e.message.toString().getBytes(StandardCharsets.UTF_8));
+            logger.error(
+                    "buildRequestAndInvokeEngine catch ScriptReturnException");
+            return builder.create();
         } catch (Exception e) {
             ByteArrayOutputStream bo = new ByteArrayOutputStream();
             e.printStackTrace(new PrintStream(bo));