What causes "请求方式不支持！" in xkcoding/spring-boot-demo?

Use an HTTP method the endpoint declares

xkcoding/spring-boot-demo · warning · SecurityException

405

405

Error message

请求方式不支持！

What it means

RbacAuthorityService.checkRequest iterates registered URL mappings; if AntPathRequestMatcher matches the path but the request's HTTP method is not among the registered methods for that URI, it throws SecurityException(Status.HTTP_BAD_METHOD, code 405) at README:537 (impl RbacAuthorityService.java:105). Spring's own HttpRequestMethodNotSupportedException is also mapped to the same code by GlobalExceptionHandler.

Source

Thrown at demo-rbac-security/README.md:537

     * 校验请求是否存在
     *
     * @param request 请求
     */
    private void checkRequest(HttpServletRequest request) {
        // 获取当前 request 的方法
        String currentMethod = request.getMethod();
        Multimap<String, String> urlMapping = allUrlMapping();

        for (String uri : urlMapping.keySet()) {
            // 通过 AntPathRequestMatcher 匹配 url
            // 可以通过 2 种方式创建 AntPathRequestMatcher
            // 1：new AntPathRequestMatcher(uri,method) 这种方式可以直接判断方法是否匹配，因为这里我们把 方法不匹配 自定义抛出，所以，我们使用第2种方式创建
            // 2：new AntPathRequestMatcher(uri) 这种方式不校验请求方法，只校验请求路径
            AntPathRequestMatcher antPathMatcher = new AntPathRequestMatcher(uri);
            if (antPathMatcher.matches(request)) {
                if (!urlMapping.get(uri)
                        .contains(currentMethod)) {
                    throw new SecurityException(Status.HTTP_BAD_METHOD);
                } else {
                    return;
                }
            }
        }

        throw new SecurityException(Status.REQUEST_NOT_FOUND);
    }

    /**
     * 获取 所有URL Mapping，返回格式为{"/test":["GET","POST"],"/sys":["GET","DELETE"]}
     *
     * @return {@link ArrayListMultimap} 格式的 URL Mapping
     */
    private Multimap<String, String> allUrlMapping() {
        Multimap<String, String> urlMapping = ArrayListMultimap.create();

        // 获取url与类和方法的对应信息

View on GitHub (pinned to 87a142f960)

Solutions

Use an HTTP method the endpoint declares
Add the missing verb to @RequestMapping if it should be supported
Return 405 with an Allow header listing the supported methods

Defensive patterns

Strategy: validation

Validate before calling

Set<RequestMethod> allowed = mapping.getHandlerMethods().entrySet().stream()
    .filter(e -> e.getKey().getPatternsCondition().getPatterns().contains(request.getRequestURI()))
    .flatMap(e -> e.getKey().getMethodsCondition().getMethods().stream())
    .collect(Collectors.toSet());
if (!allowed.contains(RequestMethod.valueOf(request.getMethod()))) {
    // 405 - use a supported verb
}

Try / catch

try { authorityService.checkRequest(request); }
catch (SecurityException e) { if (Status.HTTP_BAD_METHOD.getCode().equals(e.getCode())) { /* return 405 with Allow header */ } }

Prevention

Match the client verb to the endpoint's declared methods
Declare explicit HTTP methods on @RequestMapping
Surface supported methods in a 405 Allow header

When it happens

Trigger: Calling a mapped path with a verb it does not expose, e.g. PUT /api/user when only GET and POST are registered.

Common situations: Client using the wrong method; REST verb mismatch; an endpoint whose @RequestMapping lacks a method restriction (empty method set).

Related errors

AI-assisted analysis of xkcoding/spring-boot-demo@87a142f960 (2026-08-14). Data as JSON: /api/errors/6d2452ab9a8e07d2. Report an issue: GitHub.