{"record":{"id":"87868fd03db03548","repo":"wuyouzhuguli/SpringAll","slug":"authentication-method-not-supported-method","errorCode":null,"errorMessage":"Authentication method not supported: {method}","messagePattern":"Authentication method not supported: (.+?)","errorType":"exception","errorClass":"AuthenticationServiceException","httpStatus":null,"severity":"warning","filePath":"59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsAuthenticationFilter.java","lineNumber":29,"sourceCode":"import javax.servlet.http.HttpServletResponse;\n\npublic class SmsAuthenticationFilter extends AbstractAuthenticationProcessingFilter {\n\n    public static final String MOBILE_KEY = \"mobile\";\n\n    private String mobileParameter = MOBILE_KEY;\n    private boolean postOnly = true;\n\n\n    public SmsAuthenticationFilter() {\n        super(new AntPathRequestMatcher(\"/login/mobile\", \"POST\"));\n    }\n\n\n    public Authentication attemptAuthentication(HttpServletRequest request,\n                                                HttpServletResponse response) throws AuthenticationException {\n        if (postOnly && !request.getMethod().equals(\"POST\")) {\n            throw new AuthenticationServiceException(\n                    \"Authentication method not supported: \" + request.getMethod());\n        }\n\n        String mobile = obtainMobile(request);\n\n        if (mobile == null) {\n            mobile = \"\";\n        }\n\n        mobile = mobile.trim();\n\n        SmsAuthenticationToken authRequest = new SmsAuthenticationToken(mobile);\n\n        setDetails(request, authRequest);\n\n        return this.getAuthenticationManager().authenticate(authRequest);\n    }\n","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsAuthenticationFilter.java#L11-L47","documentation":"Thrown by SmsAuthenticationFilter.attemptAuthentication as an AuthenticationServiceException when postOnly is true (default) and the request to /login/mobile is not a POST. The filter is constructed with AntPathRequestMatcher(\"/login/mobile\",\"POST\"), so only POST reaches it; a GET/PUT/etc. is rejected before any credential processing.","triggerScenarios":"A client sends GET (or PUT/DELETE) to /login/mobile; a browser navigating to the URL directly; a misconfigured form without method=\"post\"; an API client defaulting to GET.","commonSituations":"Form missing method=\"post\"; curl/AJAX call without specifying method; redirect or link that performs a GET; integration test using the wrong verb.","solutions":["Send the mobile-login request as an HTTP POST to /login/mobile.","Verify the form tag has method=\"post\" and the AJAX call uses method:'POST'.","If non-POST is genuinely required, set postOnly=false on the filter (not recommended for security).","Check proxy/redirect rules that might rewrite POST to GET."],"exampleFix":"// before\nfetch('/login/mobile?mobile=13800000000');\n\n// after\nfetch('/login/mobile', { method: 'POST', body: new URLSearchParams({mobile:'13800000000'}) });","handlingStrategy":"validation","validationCode":"// client-side: always POST to /login/mobile\nif (method !== 'POST') { throw new Error('mobile login must be POST'); }","typeGuard":null,"tryCatchPattern":"// catch AuthenticationServiceException and inform client to use POST\ntry { ... } catch (AuthenticationServiceException e) { res.sendError(405, e.getMessage()); }","preventionTips":["Hard-code method:'POST' for mobile login.","Verify form method attribute.","Watch for proxies that rewrite POST to GET."],"tags":["spring-security","authentication","sms","http-method","java"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}