diff --git a/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SandboxServiceImpl.java b/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SandboxServiceImpl.java
index e0315584f0ae..da9e819ddf51 100644
--- a/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SandboxServiceImpl.java
+++ b/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/SandboxServiceImpl.java
@@ -90,13 +90,12 @@ public void requestProxyGateway(final ProxyGatewayDTO proxyGatewayDTO, final Htt
             throw new ShenyuException(proxyHostPort + " is not allowed.");
         }
 
-        String signContent = null;
         String sign = null;
+        String timestamp = String.valueOf(Instant.now().toEpochMilli());
         if (StringUtils.isNotEmpty(appKey)) {
-            String timestamp = String.valueOf(Instant.now().toEpochMilli());
             String secureKey = getSecureKey(appKey);
             Assert.notBlack(secureKey, Constants.SIGN_APP_KEY_IS_NOT_EXIST);
-            signContent = ShenyuSignatureUtils.getSignContent(secureKey, timestamp, uriComponents.getPath());
+            String signContent = ShenyuSignatureUtils.getSignContent(secureKey, timestamp, uriComponents.getPath());
             sign = ShenyuSignatureUtils.generateSign(signContent);
             header.put("timestamp", timestamp);
             header.put("appKey", appKey);
@@ -114,7 +113,10 @@ public void requestProxyGateway(final ProxyGatewayDTO proxyGatewayDTO, final Htt
                 return;
             }
             if (StringUtils.isNotEmpty(appKey)) {
-                response.addHeader("sandbox-beforesign", UriUtils.encode(signContent, StandardCharsets.UTF_8));
+                String signContentWithoutSecret = "path" + uriComponents.getPath()
+                        + "timestamp" + timestamp
+                        + "version" + ShenyuSignatureUtils.VERSION;
+                response.addHeader("sandbox-beforesign", UriUtils.encode(signContentWithoutSecret, StandardCharsets.UTF_8));
                 response.addHeader("sandbox-sign", UriUtils.encode(sign, StandardCharsets.UTF_8));
             }
 
diff --git a/shenyu-admin/src/test/java/org/apache/shenyu/admin/service/impl/SandboxServiceImplTest.java b/shenyu-admin/src/test/java/org/apache/shenyu/admin/service/impl/SandboxServiceImplTest.java
index a0d1db0f4d51..b2d98607129f 100644
--- a/shenyu-admin/src/test/java/org/apache/shenyu/admin/service/impl/SandboxServiceImplTest.java
+++ b/shenyu-admin/src/test/java/org/apache/shenyu/admin/service/impl/SandboxServiceImplTest.java
@@ -25,6 +25,7 @@
 import java.util.Collections;
 
 import org.apache.shenyu.admin.model.dto.ProxyGatewayDTO;
+import org.apache.shenyu.admin.model.entity.AppAuthDO;
 import org.apache.shenyu.admin.model.vo.ShenyuDictVO;
 import org.apache.shenyu.admin.service.AppAuthService;
 import org.apache.shenyu.admin.service.ShenyuDictService;
@@ -69,6 +70,35 @@ void requestProxyGatewayShouldCopyBody() throws IOException {
         }
     }
 
+    @Test
+    void requestProxyGatewayShouldNotExposeAppSecretInBeforeSignHeader() throws IOException {
+        HttpServer server = startHttpServer("proxied response");
+        int port = server.getAddress().getPort();
+        SandboxServiceImpl sandboxService = new SandboxServiceImpl(appAuthService, shenyuDictService);
+
+        when(shenyuDictService.list(anyString())).thenReturn(Collections.singletonList(buildDict(port)));
+
+        String testAppKey = "testAppKey";
+        String testAppSecret = "testSecret123";
+        AppAuthDO appAuthDO = new AppAuthDO(testAppKey, testAppSecret, true, true, null, null, null, null);
+        when(appAuthService.findByAppKey(testAppKey)).thenReturn(appAuthDO);
+
+        try {
+            MockHttpServletResponse response = new MockHttpServletResponse();
+            ProxyGatewayDTO dto = buildProxyGatewayDTO(port);
+            dto.setAppKey(testAppKey);
+            sandboxService.requestProxyGateway(dto, new MockHttpServletRequest(), response);
+
+            String beforesign = response.getHeader("sandbox-beforesign");
+            assertThat(beforesign).doesNotContain(testAppSecret);
+
+            String sign = response.getHeader("sandbox-sign");
+            assertThat(sign).isNotNull();
+        } finally {
+            server.stop(0);
+        }
+    }
+
     private ProxyGatewayDTO buildProxyGatewayDTO(final int port) {
         ProxyGatewayDTO proxyGatewayDTO = new ProxyGatewayDTO();
         proxyGatewayDTO.setRequestUrl("http://localhost:" + port + "/proxy");