xkcoding/spring-boot-demo · warning · SecurityException

404

404

Error message

请求不存在！

What it means

If no registered URI pattern matches the request path at all, checkRequest throws SecurityException(Status.REQUEST_NOT_FOUND, code 404) at README:544 (impl RbacAuthorityService.java:112). This is the app's own 404 inside the security filter; Spring's NoHandlerFoundException maps to the same code via GlobalExceptionHandler (requires throw-exception-if-no-handler-found enabled).

Source

Thrown at demo-rbac-security/README.md:544

        Multimap<String, String> urlMapping = allUrlMapping();

        for (String uri : urlMapping.keySet()) {
            // 通过 AntPathRequestMatcher 匹配 url
            // 可以通过 2 种方式创建 AntPathRequestMatcher
            // 1：new AntPathRequestMatcher(uri,method) 这种方式可以直接判断方法是否匹配，因为这里我们把 方法不匹配 自定义抛出，所以，我们使用第2种方式创建
            // 2：new AntPathRequestMatcher(uri) 这种方式不校验请求方法，只校验请求路径
            AntPathRequestMatcher antPathMatcher = new AntPathRequestMatcher(uri);
            if (antPathMatcher.matches(request)) {
                if (!urlMapping.get(uri)
                        .contains(currentMethod)) {
                    throw new SecurityException(Status.HTTP_BAD_METHOD);
                } else {
                    return;
                }
            }
        }

        throw new SecurityException(Status.REQUEST_NOT_FOUND);
    }

    /**
     * 获取 所有URL Mapping，返回格式为{"/test":["GET","POST"],"/sys":["GET","DELETE"]}
     *
     * @return {@link ArrayListMultimap} 格式的 URL Mapping
     */
    private Multimap<String, String> allUrlMapping() {
        Multimap<String, String> urlMapping = ArrayListMultimap.create();

        // 获取url与类和方法的对应信息
        Map<RequestMappingInfo, HandlerMethod> handlerMethods = mapping.getHandlerMethods();

        handlerMethods.forEach((k, v) -> {
            // 获取当前 key 下的获取所有URL
            Set<String> url = k.getPatternsCondition()
                    .getPatterns();
            RequestMethodsRequestCondition method = k.getMethodsCondition();

View on GitHub (pinned to 87a142f960)

Solutions

  1. Verify the path against the controller mappings
  2. Correct the client base URL or context path
  3. Register the route if it is supposed to exist
Defensive patterns

Strategy: validation

Validate before calling

boolean mapped = mapping.getHandlerMethods().keySet().stream()
    .anyMatch(info -> info.getPatternsCondition().getPatterns().contains(request.getRequestURI()));
if (!mapped) { /* 404 - correct the path or register the route */ }

Try / catch

try { authorityService.checkRequest(request); }
catch (SecurityException e) { if (Status.REQUEST_NOT_FOUND.getCode().equals(e.getCode())) { /* 404 */ } }

Prevention

When it happens

Trigger: Request to a path with no @RequestMapping; a typo; a removed endpoint; a context-path mismatch.

Common situations: Stale client calling a removed route; wrong API base path; missing servlet context path in the client URL.

Related errors

AI-assisted analysis of xkcoding/spring-boot-demo@87a142f960 (2026-08-14). Data as JSON: /api/errors/890468fc174fb343. Report an issue: GitHub.