{"record":{"id":"b70a41ab0c1a9177","repo":"paascloud/paascloud-master","slug":"authentication-method-not-supported-b70a41","errorCode":null,"errorMessage":"Authentication method not supported: ","messagePattern":"Authentication method not supported: ","errorType":"http","errorClass":"AuthenticationServiceException","httpStatus":401,"severity":"error","filePath":"paascloud-common/paascloud-security-core/src/main/java/com/paascloud/security/core/authentication/mobile/SmsCodeAuthenticationFilter.java","lineNumber":54,"sourceCode":"\n\t// ~ Methods\n\t// ========================================================================================================\n\n\t/**\n\t * Attempt authentication authentication.\n\t *\n\t * @param request  the request\n\t * @param response the response\n\t *\n\t * @return the authentication\n\t *\n\t * @throws AuthenticationException the authentication exception\n\t */\n\t@Override\n\tpublic Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)\n\t\t\tthrows AuthenticationException {\n\t\tif (postOnly && !POST.equals(request.getMethod())) {\n\t\t\tthrow new AuthenticationServiceException(\"Authentication method not supported: \" + request.getMethod());\n\t\t}\n\n\t\tString mobile = obtainMobile(request);\n\n\t\tif (mobile == null) {\n\t\t\tmobile = \"\";\n\t\t}\n\n\t\tmobile = mobile.trim();\n\n\t\tSmsCodeAuthenticationToken authRequest = new SmsCodeAuthenticationToken(mobile);\n\n\t\t// Allow subclasses to set the \"details\" property\n\t\tsetDetails(request, authRequest);\n\n\t\treturn this.getAuthenticationManager().authenticate(authRequest);\n\t}\n","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-common/paascloud-security-core/src/main/java/com/paascloud/security/core/authentication/mobile/SmsCodeAuthenticationFilter.java#L36-L72","documentation":"SmsCodeAuthenticationFilter.attemptAuthentication throws AuthenticationServiceException('Authentication method not supported: ' + method) when the SMS-code login endpoint is hit with a non-POST method while postOnly is true (default). Only POST requests carrying the mobile parameter are processed by this filter.","triggerScenarios":"GET (or PUT/DELETE) request to the SMS authentication processing URL (default /auth/mobile) — e.g. typing the URL in a browser, a curl GET, or a client redirect that converts POST to GET.","commonSituations":"Manually testing the mobile login endpoint; frontend issuing redirect after failure which re-requests with GET; gateway rewrite of the method; missing -X POST in curl tests.","solutions":["Issue the SMS login request as HTTP POST with the mobile parameter.","If non-POST access must be allowed, construct SmsCodeAuthenticationFilter with postOnly=false.","Fix client redirect logic so the login form actually POSTs to the filter URL.","Confirm the filter's request matcher matches the URL your client posts to."],"exampleFix":"// before\nfetch('/auth/mobile?mobile=13800000000')  // GET\n// after\nfetch('/auth/mobile', { method: 'POST', body: new URLSearchParams({ mobile: '13800000000' }) })","handlingStrategy":"validation","validationCode":"if (!\"POST\".equalsIgnoreCase(httpMethod)) {\n    throw new IllegalArgumentException(\"SMS login must be POST\");\n}\nif (mobile == null || mobile.isBlank()) {\n    throw new IllegalArgumentException(\"mobile is required\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Authentication result = filter.attemptAuthentication(request, response);\n} catch (AuthenticationServiceException e) {\n    response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, \"Use POST\");\n}","preventionTips":["POST mobile login credentials, never GET.","Keep postOnly=true to reject non-POST.","Verify redirects preserve the POST method or re-issue the form post."],"tags":["java","spring-security","sms","http-method","authentication"],"backgroundTag":"http-method-not-allowed","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}