diff --git a/Chapter9-1-5/api-gateway/src/main/java/com/didispace/Application.java b/Chapter9-1-5/api-gateway/src/main/java/com/didispace/Application.java
index 225959c..e041695 100644
--- a/Chapter9-1-5/api-gateway/src/main/java/com/didispace/Application.java
+++ b/Chapter9-1-5/api-gateway/src/main/java/com/didispace/Application.java
@@ -1,8 +1,10 @@
 package com.didispace;
 
+import com.didispace.filter.AccessFilter;
 import org.springframework.boot.builder.SpringApplicationBuilder;
 import org.springframework.cloud.client.SpringCloudApplication;
 import org.springframework.cloud.netflix.zuul.EnableZuulProxy;
+import org.springframework.context.annotation.Bean;
 
 @EnableZuulProxy
 @SpringCloudApplication
@@ -12,4 +14,9 @@ public class Application {
 		new SpringApplicationBuilder(Application.class).web(true).run(args);
 	}
 
+	@Bean
+	public AccessFilter accessFilter() {
+		return new AccessFilter();
+	}
+
 }
diff --git a/Chapter9-1-5/api-gateway/src/main/java/com/didispace/filter/AccessFilter.java b/Chapter9-1-5/api-gateway/src/main/java/com/didispace/filter/AccessFilter.java
new file mode 100644
index 0000000..489e6aa
--- /dev/null
+++ b/Chapter9-1-5/api-gateway/src/main/java/com/didispace/filter/AccessFilter.java
@@ -0,0 +1,47 @@
+package com.didispace.filter;
+
+import com.netflix.zuul.ZuulFilter;
+import com.netflix.zuul.context.RequestContext;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.servlet.http.HttpServletRequest;
+
+public class AccessFilter extends ZuulFilter  {
+
+    private static Logger log = LoggerFactory.getLogger(AccessFilter.class);
+
+    @Override
+    public String filterType() {
+        return "pre";
+    }
+
+    @Override
+    public int filterOrder() {
+        return 0;
+    }
+
+    @Override
+    public boolean shouldFilter() {
+        return true;
+    }
+
+    @Override
+    public Object run() {
+        RequestContext ctx = RequestContext.getCurrentContext();
+        HttpServletRequest request = ctx.getRequest();
+
+        log.info(String.format("%s request to %s", request.getMethod(), request.getRequestURL().toString()));
+
+        Object accessToken = request.getParameter("accessToken");
+        if(accessToken == null) {
+            log.warn("access token is empty");
+            ctx.setSendZuulResponse(false);
+            ctx.setResponseStatusCode(401);
+            return null;
+        }
+        log.info("access token ok");
+        return null;
+    }
+
+}