No configuration /error is accessible in WebSecurityConfig, resulting in real error loss

[brucelwl]

SpringBoot 默认配置了 /error 页面, tomcat 发现错误的时候, 如果配置了错误页面,就会转发到错误页面, 然后又经过过滤器, 安全过滤器发现 /error页面没有授权, 所以一直是 401 错误, com.alibaba.nacos.naming.misc.HttpClient 在401请求中又没有拿到输入流, 抛出500, 其实它想汇报的是 400的错误。

建议设置
com.alibaba.nacos.console.config.WebSecurityConfig 中设置 /error 可访问
或者不要使用
resp.sendError(400,"error message")
换成
resp.setStatus(400);
resp.getWriter().write("error message");

服务器访问自己抛出400异常
com.alibaba.nacos.naming.web.DistroFilter

出现异常tomcat转发到/error页面，被Security拦截，抛出401异常
com.alibaba.nacos.console.config.WebSecurityConfig

HttpClient收到401状态码，输入流是null，解析输入流抛出500异常，本应该是400的异常却变成了500异常，导致排查问题困难。巨坑！！！
com.alibaba.nacos.naming.misc.HttpClient

[nacos-bot]

Hi @brucelwl, we detect non-English characters in the issue. This comment is an auto translation from @nacos-bot to help other users to understand this issue.
We encourage you to describe your issue in English which is more friendly to other users.

No configuration /error is accessible in WebSecurityConfig, resulting in real abnormal loss

SpringBoot configures the /error page by default. When tomcat finds an error, if an error page is configured, it will be forwarded to the error page, and then through the filter. The security filter finds that the /error page is not authorized, so it is always a 401 error, com .alibaba.nacos.naming.misc.HttpClient did not get the input stream in the 401 request, throwing 500, in fact, it wants to report a 400 error.

Recommended setting
com.alibaba.nacos.console.config.WebSecurityConfig set /error accessible
Or don't use
resp.sendError(400,"error message")
Change to
resp.setStatus(400);
resp.getWriter().write("error message");

Server access throws 400 exceptions
com.alibaba.nacos.naming.web.DistroFilter

An exception tomcat is forwarded to the /error page, intercepted by Security, throwing a 401 exception
com.alibaba.nacos.console.config.WebSecurityConfig

HttpClient receives the 401 status code, the input stream is null, and the parsing input stream throws a 500 exception. The exception that should have been 400 becomes a 500 exception, which makes the troubleshooting problem difficult. Giant pit! ! !
com.alibaba.nacos.naming.misc.HttpClient