Spring Security: how to intercept PageNotFound

Question

This seems to be an easy question but we couldn't find it anywhere on internet.

We're using Spring Security 3.2 and we want to be able to print the IP of the remote host whenever we get the spring message:

WARN  [org.springframework.web.servlet.PageNotFound] - No mapping found for HTTP request with URI [/page.bla] in DispatcherServlet with name 'XXX'.

How can we possibly do that?

score 1 · Answer 1 · answered Apr 30 '14 at 19:45

1

This is only a partial answer; it solves the problem but not using spring security.

Create a filter that checks the status in the response (response.getStatus()). If the status code is one that you care about (for example 404 or HttpServletResponse.SC_NOT_FOUND) log a message with the details from the request that you want to store.

answered Apr 30 '14 at 19:45

DwB

37,124
11
56
82

Well, doing that we would end up with two lines of log. We really would like to intercept the one that is showing up from PageNotFound. Anyway, if no appropriate answer show up here in the next two days, I will mark yours as the right answer. – danielnovy Apr 30 '14 at 21:19

score 1 · Accepted Answer · answered May 01 '14 at 14:23

Your problem is not related to spring-security. This log message is generated in DispatcherServlet class.

You can extend org.springframework.web.servlet.DispatcherServlet and override protected void noHandlerFound(HttpServletRequest request, HttpServletResponse response) throws Exception method:

protected void noHandlerFound(HttpServletRequest request, HttpServletResponse response) throws Exception {
    if (pageNotFoundLogger.isWarnEnabled()) {
        String requestUri = urlPathHelper.getRequestUri(request);
        pageNotFoundLogger.warn("No mapping found for HTTP request with URI [" + requestUri +"] in DispatcherServlet with name '" + getServletName() + "'");
    }
    response.sendError(HttpServletResponse.SC_NOT_FOUND);
}

In this way you can customize logging message and add to it the ip address from HttpServletRequest parameter:

request.getRemoteAddr();

I'm not sure that it is a good practice.. but it should works.

Hope this helps!!

Worked like a charm! Just one minor change: the "urlPathHelper" is not visible from within the class. Just changed it to "request.getServletPath()" and the problem is gone. Thank you! — danielnovy, May 01 '14 at 15:04
I think that it should not be a problem. It is used only for logging purpose.. You are wellcome — gipinani, May 01 '14 at 15:06

score 1 · Answer 3 · answered Oct 04 '17 at 13:35

Since Spring 4.0, if you're using @ControllerAdvice, you can also enable the fact that Spring throws a NoHandlerFoundException when it detects PageNotFound by configuring the DispatcherServlet:

@Configuration
public class ApplicationConfiguration {

    @Autowired
    void configureDispatcherServlet( DispatcherServlet dispatcherServlet ) {
        dispatcherServlet.setThrowExceptionIfNoHandlerFound(true);
    }
}

Then, in your @ControllerAdvice, you'll be able to handle this exception to return custom data:

@ControllerAdvice
public class GlobalExceptionHandler {

    @ExceptionHandler
    ResponseEntity<MyCustomError> handle(NoHandlerFoundException e) {

        return new ResponseEntity<>(new MyCustomError(), HttpStatus.NOT_FOUND);
    }
}

I think this is the simplest answer. This can also be done with the property `spring.mvc.throw-exception-if-no-handler-found=true`. You can also disable the original warning by adding the property `logging.level.org.springframework.web.servlet.PageNotFound=ERROR` — rougou, Apr 03 '19 at 10:44
But if you have a custom handler anyways, how do you disable the WARN log from `org.springframework.web.servlet.PageNotFound` saying "No mapping for GET /resource"? — Snackoverflow, Feb 03 '20 at 09:00

Spring Security: how to intercept PageNotFound

3 Answers3

Linked