xkcoding/spring-boot-demo · warning · SecurityException
405
405
Error message
请求方式不支持！
What it means
Thrown by RbacAuthorityService.checkRequest when the request URL path matches a registered mapping but the HTTP method (GET/POST/PUT/DELETE etc.) is not in that mapping's allowed method list. This is a 405 Method Not Error. The SecurityException wraps Status.HTTP_BAD_METHOD (code 405). This fires during dynamic URL-based authorization before permission checking proceeds.
Source
Thrown at demo-rbac-security/src/main/java/com/xkcoding/rbac/security/config/RbacAuthorityService.java:105
/**
* 校验请求是否存在
*
* @param request 请求
*/
private void checkRequest(HttpServletRequest request) {
// 获取当前 request 的方法
String currentMethod = request.getMethod();
Multimap<String, String> urlMapping = allUrlMapping();
for (String uri : urlMapping.keySet()) {
// 通过 AntPathRequestMatcher 匹配 url
// 可以通过 2 种方式创建 AntPathRequestMatcher
// 1：new AntPathRequestMatcher(uri,method) 这种方式可以直接判断方法是否匹配，因为这里我们把 方法不匹配 自定义抛出，所以，我们使用第2种方式创建
// 2：new AntPathRequestMatcher(uri) 这种方式不校验请求方法，只校验请求路径
AntPathRequestMatcher antPathMatcher = new AntPathRequestMatcher(uri);
if (antPathMatcher.matches(request)) {
if (!urlMapping.get(uri).contains(currentMethod)) {
throw new SecurityException(Status.HTTP_BAD_METHOD);
} else {
return;
}
}
}
throw new SecurityException(Status.REQUEST_NOT_FOUND);
}
/**
* 获取 所有URL Mapping，返回格式为{"/test":["GET","POST"],"/sys":["GET","DELETE"]}
*
* @return {@link ArrayListMultimap} 格式的 URL Mapping
*/
private Multimap<String, String> allUrlMapping() {
Multimap<String, String> urlMapping = ArrayListMultimap.create();
// 获取url与类和方法的对应信息View on GitHub (pinned to 87a142f960)
Solutions
- Check the API endpoint's allowed methods and use the correct HTTP verb.
- Verify the @RequestMapping/@GetMapping/@PostMapping annotation on the target controller method.
- Ensure no proxy/load balancer is rewriting the HTTP method.
- Confirm the SecurityException is handled by a @ControllerAdvice that returns a 405 response.
Defensive patterns
Strategy: try-catch
Validate before calling
// Client-side: verify the endpoint accepts the HTTP method before sending // Use the actuator /mappings endpoint or OpenAPI spec to confirm allowed methods. // No runtime pre-check API in the security layer.
Try / catch
// In a @ControllerAdvice handler for SecurityException
@ExceptionHandler(SecurityException.class)
@ResponseBody
public ResponseEntity<ApiResponse> handleSecurityException(SecurityException e) {
Status status = e.getStatus(); // or extract code/message
if (status.getCode() == 405) {
return ResponseEntity.status(405).body(ApiResponse.ofStatus(Status.HTTP_BAD_METHOD));
}
// ... handle other codes
return ResponseEntity.status(500).body(ApiResponse.ofStatus(Status.ERROR));
} Prevention
- Always use the correct HTTP verb per the API specification.
- Keep API documentation in sync with controller annotations.
- Verify no proxy is rewriting the HTTP method.
- Ensure the SecurityException handler maps code 405 to an HTTP 405 response.
When it happens
Trigger: Sending a request whose path matches a registered controller endpoint but using an HTTP verb that endpoint does not support — e.g., POST to an endpoint that only allows GET. The AntPathRequestMatcher matches on path only, then urlMapping.get(uri).contains(currentMethod) returns false.
Common situations: Frontend sends the wrong HTTP method (e.g., PUT instead of PATCH); API documentation is out of date; a proxy or gateway rewrites the method; curl/client using the wrong verb; new endpoint method not yet registered in the URL mapping.
Related errors
AI-assisted analysis of xkcoding/spring-boot-demo@87a142f960 (2026-08-14).
Data as JSON: /api/errors/b8b2366d8de7ffed.
Report an issue: GitHub.