{"record":{"id":"8666d76479113868","repo":"wuyouzhuguli/SpringAll","slug":"authentication-method-not-supported-method-8666d7","errorCode":null,"errorMessage":"Authentication method not supported: {method}","messagePattern":"Authentication method not supported: (.+?)","errorType":"exception","errorClass":"AuthenticationServiceException","httpStatus":null,"severity":"error","filePath":"61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsAuthenticationFilter.java","lineNumber":29,"sourceCode":"import javax.servlet.http.HttpServletResponse;\n\npublic class SmsAuthenticationFilter extends AbstractAuthenticationProcessingFilter {\n\n    public static final String MOBILE_KEY = \"mobile\";\n\n    private String mobileParameter = MOBILE_KEY;\n    private boolean postOnly = true;\n\n\n    public SmsAuthenticationFilter() {\n        super(new AntPathRequestMatcher(\"/login/mobile\", \"POST\"));\n    }\n\n\n    public Authentication attemptAuthentication(HttpServletRequest request,\n                                                HttpServletResponse response) throws AuthenticationException {\n        if (postOnly && !request.getMethod().equals(\"POST\")) {\n            throw new AuthenticationServiceException(\n                    \"Authentication method not supported: \" + request.getMethod());\n        }\n\n        String mobile = obtainMobile(request);\n\n        if (mobile == null) {\n            mobile = \"\";\n        }\n\n        mobile = mobile.trim();\n\n        SmsAuthenticationToken authRequest = new SmsAuthenticationToken(mobile);\n\n        setDetails(request, authRequest);\n\n        return this.getAuthenticationManager().authenticate(authRequest);\n    }\n","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsAuthenticationFilter.java#L11-L47","documentation":"AuthenticationServiceException thrown by SmsAuthenticationFilter.attemptAuthentication when postOnly=true (the default) and the HTTP method of the request to /login/mobile is not POST. The filter is constructed with AntPathRequestMatcher(\"/login/mobile\", \"POST\"), so SMS login is POST-only by design.","triggerScenarios":"Any GET/PUT/DELETE/etc. request to /login/mobile; an OPTIONS preflight from a cross-origin browser that is not handled by CORS infrastructure and reaches the filter; a frontend form using method=\"get\".","commonSituations":"Frontend axios/fetch defaulting to GET; misconfigured CORS so the OPTIONS preflight hits the auth filter instead of a CorsFilter; API client using the wrong verb; browser navigation/form defaulting to GET.","solutions":["Send the SMS login request as POST to /login/mobile with mobile (and smsCode) in the body.","Register a CorsFilter / CorsConfigurationSource that handles OPTIONS before Spring Security, so preflights do not reach SmsAuthenticationFilter.","If you genuinely need other verbs, set the filter's postOnly=false (not recommended for authentication)."],"exampleFix":"// before\n// fetch('/login/mobile?mobile=13800000000&smsCode=123456')\n\n// after\nfetch('/login/mobile', {\n  method: 'POST',\n  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n  body: 'mobile=13800000000&smsCode=123456'\n});","handlingStrategy":"validation","validationCode":"// Guard the verb before calling.\nfunction smsLogin(mobile, code) {\n  return fetch('/login/mobile', {\n    method: 'POST', // always POST\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({ mobile, smsCode: code })\n  });\n}","typeGuard":null,"tryCatchPattern":"try { await smsLogin(mobile, code); }\ncatch (e) {\n  if (/not supported/i.test(e.message)) { /* ensure POST was used; check CORS/OPTIONS */ }\n  else handleError(e);\n}","preventionTips":["Hardcode method:'POST' for /login/mobile in the client wrapper.","Configure CORS so OPTIONS preflights are answered before the security filter chain.","Add an integration test asserting GET /login/mobile is rejected."],"tags":["spring-security","sms","authentication","http-method","cors"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}