xkcoding/spring-boot-demo · warning · SecurityException

404

404

Error message

请求不存在！

What it means

Thrown by RbacAuthorityService.checkRequest when no registered URL pattern matches the incoming request path at all. After iterating all URI patterns in urlMapping, none matched via AntPathRequestMatcher, so the loop completes without returning, and Status.REQUEST_NOT_FOUND (404) is thrown. This fires during dynamic authorization before permission checks.

Source

Thrown at demo-rbac-security/src/main/java/com/xkcoding/rbac/security/config/RbacAuthorityService.java:112

        String currentMethod = request.getMethod();
        Multimap<String, String> urlMapping = allUrlMapping();

        for (String uri : urlMapping.keySet()) {
            // 通过 AntPathRequestMatcher 匹配 url
            // 可以通过 2 种方式创建 AntPathRequestMatcher
            // 1：new AntPathRequestMatcher(uri,method) 这种方式可以直接判断方法是否匹配，因为这里我们把 方法不匹配 自定义抛出，所以，我们使用第2种方式创建
            // 2：new AntPathRequestMatcher(uri) 这种方式不校验请求方法，只校验请求路径
            AntPathRequestMatcher antPathMatcher = new AntPathRequestMatcher(uri);
            if (antPathMatcher.matches(request)) {
                if (!urlMapping.get(uri).contains(currentMethod)) {
                    throw new SecurityException(Status.HTTP_BAD_METHOD);
                } else {
                    return;
                }
            }
        }

        throw new SecurityException(Status.REQUEST_NOT_FOUND);
    }

    /**
     * 获取 所有URL Mapping，返回格式为{"/test":["GET","POST"],"/sys":["GET","DELETE"]}
     *
     * @return {@link ArrayListMultimap} 格式的 URL Mapping
     */
    private Multimap<String, String> allUrlMapping() {
        Multimap<String, String> urlMapping = ArrayListMultimap.create();

        // 获取url与类和方法的对应信息
        Map<RequestMappingInfo, HandlerMethod> handlerMethods = mapping.getHandlerMethods();

        handlerMethods.forEach((k, v) -> {
            // 获取当前 key 下的获取所有URL
            Set<String> url = k.getPatternsCondition().getPatterns();
            RequestMethodsRequestCondition method = k.getMethodsCondition();

View on GitHub (pinned to 87a142f960)

Solutions

1. Verify the request URL is correct and matches a registered endpoint.
2. Check the controller's @RequestMapping path and ensure the request path aligns.
3. Review the application's full URL mapping (e.g., via actuator /mappings endpoint) to find the correct path.
4. Ensure the SecurityException handler returns a proper 404 response body.

// Client-side: verify the URL path matches a registered endpoint
// Use the actuator /mappings endpoint to list all registered paths.
// No runtime pre-check in the security layer.

// In a @ControllerAdvice handler for SecurityException
@ExceptionHandler(SecurityException.class)
@ResponseBody
public ResponseEntity<ApiResponse> handleSecurityException(SecurityException e) {
    Status status = e.getStatus();
    if (status.getCode() == 404) {
        return ResponseEntity.status(404).body(ApiResponse.ofStatus(Status.REQUEST_NOT_FOUND));
    }
    return ResponseEntity.status(500).body(ApiResponse.ofStatus(Status.ERROR));
}

When it happens

Trigger: Sending a request to a URL path that does not map to any registered controller endpoint — e.g., a typo in the URL, a removed endpoint, or a path outside the application's registered mappings.

Common situations: Typo in the URL path; frontend pointing to a removed or renamed endpoint; API version mismatch (e.g., /api/v2/... when only /api/v1/... exists); static resource path not covered by controller mappings; request to a path handled only by a filter, not a controller.

Related errors

• 405
• 400
• 5004
• 404
• 请求错误，用户尚未登录

AI-assisted analysis of xkcoding/spring-boot-demo@87a142f960 (2026-08-14). Data as JSON: /api/errors/3c6cc04c6e209813. Report an issue: GitHub.