{"record":{"id":"984d2f4ae045337f","repo":"wuyouzhuguli/SpringAll","slug":"authentication-method-not-supported","errorCode":null,"errorMessage":"Authentication method not supported: {}","messagePattern":"Authentication method not supported: (.+?)","errorType":"exception","errorClass":"AuthenticationServiceException","httpStatus":null,"severity":"warning","filePath":"38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/smscode/SmsAuthenticationFilter.java","lineNumber":29,"sourceCode":"import javax.servlet.http.HttpServletResponse;\n\npublic class SmsAuthenticationFilter extends AbstractAuthenticationProcessingFilter {\n\n    public static final String MOBILE_KEY = \"mobile\";\n\n    private String mobileParameter = MOBILE_KEY;\n    private boolean postOnly = true;\n\n\n    public SmsAuthenticationFilter() {\n        super(new AntPathRequestMatcher(\"/login/mobile\", \"POST\"));\n    }\n\n\n    public Authentication attemptAuthentication(HttpServletRequest request,\n                                                HttpServletResponse response) throws AuthenticationException {\n        if (postOnly && !request.getMethod().equals(\"POST\")) {\n            throw new AuthenticationServiceException(\n                    \"Authentication method not supported: \" + request.getMethod());\n        }\n\n        String mobile = obtainMobile(request);\n\n        if (mobile == null) {\n            mobile = \"\";\n        }\n\n        mobile = mobile.trim();\n\n        SmsAuthenticationToken authRequest = new SmsAuthenticationToken(mobile);\n\n        setDetails(request, authRequest);\n\n        return this.getAuthenticationManager().authenticate(authRequest);\n    }\n","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/smscode/SmsAuthenticationFilter.java#L11-L47","documentation":"Spring Security's AuthenticationServiceException, thrown by SmsAuthenticationFilter.attemptAuthentication when postOnly is true (the default) and the HTTP method is not POST. The message is built by string concatenation, so the {} placeholder in the index is filled with the actual method (e.g., '... not supported: GET'). This mirrors Spring's own UsernamePasswordAuthenticationFilter behavior; the filter is wired to match only POST /login/mobile.","triggerScenarios":"Any non-POST request (GET, PUT, DELETE, OPTIONS preflight) to /login/mobile reaching SmsAuthenticationFilter.","commonSituations":"Front-end submits via GET or a misrouted fetch; developer tested the endpoint by typing the URL in the browser (GET); CORS preflight OPTIONS hits the filter because it is not excluded; the form action omits method=\"post\".","solutions":["Submit the mobile login as an HTTP POST to /login/mobile.","Ensure the front-end form/fetch uses method POST with the right Content-Type.","Configure the filter chain / CORS to handle OPTIONS preflight before this filter.","Only if intentional, set filter.setPostOnly(false) - not recommended for credential submission."],"exampleFix":"// before\n<form action=\"/login/mobile\">  <!-- defaults to GET -->\n  <input name=\"mobile\"/>\n</form>\n\n// after\n<form action=\"/login/mobile\" method=\"post\">\n  <input name=\"mobile\"/>\n  <input name=\"smsCode\"/>\n</form>","handlingStrategy":"validation","validationCode":"// front-end: only POST to the mobile login endpoint\nasync function smsLogin(mobile, smsCode) {\n    if (!mobile || !smsCode) { showError('mobile and smsCode required'); return; }\n    await fetch('/login/mobile', {\n        method: 'POST',\n        credentials: 'same-origin',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: new URLSearchParams({ mobile, smsCode })\n    });\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Submit mobile login only via POST with method=\"post\" on the form.","Exclude OPTIONS preflight from the SMS filter chain or handle CORS before it.","Do not disable postOnly; credential submission should be POST-only."],"tags":["spring-security","authentication","http-method","sms","filter"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}