{"record":{"id":"292d0a22a0316459","repo":"dromara/Sa-Token","slug":"requestpath","errorCode":null,"errorMessage":"非法请求：{requestPath}","messagePattern":"非法请求：\\{requestPath\\}","errorType":"exception","errorClass":"RequestPathInvalidException","httpStatus":null,"severity":"error","filePath":"sa-token-core/src/main/java/cn/dev33/satoken/strategy/hooks/SaFirewallCheckHookForBlackPath.java","lineNumber":65,"sourceCode":"     */\n    public void resetConfig(String... paths) {\n        this.blackPaths.clear();\n        this.blackPaths.addAll(Arrays.asList(paths));\n    }\n\n    /**\n     * 执行的方法\n     *\n     * @param req 请求对象\n     * @param res 响应对象\n     * @param extArg 扩展预留参数\n     */\n    @Override\n    public void execute(SaRequest req, SaResponse res, Object extArg) {\n        String requestPath = req.getRequestPath();\n        for (String item : blackPaths) {\n            if (requestPath.equals(item)) {\n                throw new RequestPathInvalidException(\"非法请求：\" + requestPath, requestPath);\n            }\n        }\n\n    }\n\n}\n","sourceCodeStart":47,"sourceCodeEnd":72,"githubUrl":"https://github.com/dromara/Sa-Token/blob/ac2c7f6e94a78573cf0bcb932dd8b04e68fad189/sa-token-core/src/main/java/cn/dev33/satoken/strategy/hooks/SaFirewallCheckHookForBlackPath.java#L47-L72","documentation":"The default firewall in sa-token runs a set of check hooks on every request; the BlackPath hook compares the exact request path against the configured blackPath list and throws RequestPathInvalidException on an exact match. This is a security control meant to block well-known sensitive endpoints (e.g. /actuator/health) at the framework level. The exception message includes the offending path so you can immediately see which rule fired.","triggerScenarios":"A request whose path string-exactly equals an entry in sa-token.firewall.black-path (e.g. property sa-token.firewall.black-path[0]=/druid/index.html and a GET to /druid/index.html). Only exact equality matches — no wildcards.","commonSituations":"Default blacklist entries like /actuator/health being hit by Kubernetes liveness probes or monitoring; a legitimately added public endpoint that shares a name with a default black path; copying a blacklist from another project that blocks a path your app actually serves.","solutions":["Remove or rename the offending entry in the sa-token.firewall.black-path config list","If the path must stay public, change your endpoint path so it no longer equals the blacklisted string","For infra probes, point the liveness/readiness probe at a different, unblacklisted actuator path"],"exampleFix":"# before (application.yml)\nsa-token:\n  firewall:\n    black-path:\n      - /actuator/health\n\n# after\nsa-token:\n  firewall:\n    black-path:\n      - /actuator/env","handlingStrategy":"validation","validationCode":"String path = SaHolder.getRequest().getRequestPath();\nList<String> black = SaManager.getConfig().getFirewall().getBlackPath();\nif (black.contains(path)) {\n    // reject early with your own 404/403 response\n}","typeGuard":null,"tryCatchPattern":"try {\n    chain.doFilter(req, res);\n} catch (RequestPathInvalidException e) {\n    res.setStatus(404); // do not echo the path back; log it instead\n}","preventionTips":["Keep your black-path list in version control and review it when adding new public endpoints","Point infrastructure probes at paths that are intentionally not blacklisted","Return 404 (not the exception detail) to clients so blocked paths are not disclosed"],"tags":["sa-token","firewall","security","request-path"],"backgroundTag":null,"analyzedSha":"ac2c7f6e94a78573cf0bcb932dd8b04e68fad189","analyzedAt":"2026-08-14T14:36:10.271Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}