{"record":{"id":"6d2452ab9a8e07d2","repo":"xkcoding/spring-boot-demo","slug":"405-6d2452","errorCode":"405","errorMessage":"请求方式不支持！","messagePattern":"请求方式不支持！","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"warning","filePath":"demo-rbac-security/README.md","lineNumber":537,"sourceCode":"     * 校验请求是否存在\n     *\n     * @param request 请求\n     */\n    private void checkRequest(HttpServletRequest request) {\n        // 获取当前 request 的方法\n        String currentMethod = request.getMethod();\n        Multimap<String, String> urlMapping = allUrlMapping();\n\n        for (String uri : urlMapping.keySet()) {\n            // 通过 AntPathRequestMatcher 匹配 url\n            // 可以通过 2 种方式创建 AntPathRequestMatcher\n            // 1：new AntPathRequestMatcher(uri,method) 这种方式可以直接判断方法是否匹配，因为这里我们把 方法不匹配 自定义抛出，所以，我们使用第2种方式创建\n            // 2：new AntPathRequestMatcher(uri) 这种方式不校验请求方法，只校验请求路径\n            AntPathRequestMatcher antPathMatcher = new AntPathRequestMatcher(uri);\n            if (antPathMatcher.matches(request)) {\n                if (!urlMapping.get(uri)\n                        .contains(currentMethod)) {\n                    throw new SecurityException(Status.HTTP_BAD_METHOD);\n                } else {\n                    return;\n                }\n            }\n        }\n\n        throw new SecurityException(Status.REQUEST_NOT_FOUND);\n    }\n\n    /**\n     * 获取 所有URL Mapping，返回格式为{\"/test\":[\"GET\",\"POST\"],\"/sys\":[\"GET\",\"DELETE\"]}\n     *\n     * @return {@link ArrayListMultimap} 格式的 URL Mapping\n     */\n    private Multimap<String, String> allUrlMapping() {\n        Multimap<String, String> urlMapping = ArrayListMultimap.create();\n\n        // 获取url与类和方法的对应信息","sourceCodeStart":519,"sourceCodeEnd":555,"githubUrl":"https://github.com/xkcoding/spring-boot-demo/blob/87a142f9604c1a5365b4d24d22c2c11c26a9d5ab/demo-rbac-security/README.md#L519-L555","documentation":"RbacAuthorityService.checkRequest iterates registered URL mappings; if AntPathRequestMatcher matches the path but the request's HTTP method is not among the registered methods for that URI, it throws SecurityException(Status.HTTP_BAD_METHOD, code 405) at README:537 (impl RbacAuthorityService.java:105). Spring's own HttpRequestMethodNotSupportedException is also mapped to the same code by GlobalExceptionHandler.","triggerScenarios":"Calling a mapped path with a verb it does not expose, e.g. PUT /api/user when only GET and POST are registered.","commonSituations":"Client using the wrong method; REST verb mismatch; an endpoint whose @RequestMapping lacks a method restriction (empty method set).","solutions":["Use an HTTP method the endpoint declares","Add the missing verb to @RequestMapping if it should be supported","Return 405 with an Allow header listing the supported methods"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"Set<RequestMethod> allowed = mapping.getHandlerMethods().entrySet().stream()\n    .filter(e -> e.getKey().getPatternsCondition().getPatterns().contains(request.getRequestURI()))\n    .flatMap(e -> e.getKey().getMethodsCondition().getMethods().stream())\n    .collect(Collectors.toSet());\nif (!allowed.contains(RequestMethod.valueOf(request.getMethod()))) {\n    // 405 - use a supported verb\n}","typeGuard":null,"tryCatchPattern":"try { authorityService.checkRequest(request); }\ncatch (SecurityException e) { if (Status.HTTP_BAD_METHOD.getCode().equals(e.getCode())) { /* return 405 with Allow header */ } }","preventionTips":["Match the client verb to the endpoint's declared methods","Declare explicit HTTP methods on @RequestMapping","Surface supported methods in a 405 Allow header"],"tags":["spring-security","http","method-not-allowed"],"backgroundTag":null,"analyzedSha":"87a142f9604c1a5365b4d24d22c2c11c26a9d5ab","analyzedAt":"2026-08-14T01:16:58.217Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}