{"record":{"id":"fc37f2d4003178fd","repo":"paascloud/paascloud-master","slug":"authentication-method-not-supported","errorCode":null,"errorMessage":"Authentication method not supported: ","messagePattern":"Authentication method not supported: ","errorType":"http","errorClass":"AuthenticationServiceException","httpStatus":401,"severity":"error","filePath":"paascloud-common/paascloud-security-app/src/main/java/com/paascloud/security/app/authentication/openid/OpenIdAuthenticationFilter.java","lineNumber":66,"sourceCode":"\n\t// ~ Methods\n\t// ========================================================================================================\n\n\t/**\n\t * Attempt authentication authentication.\n\t *\n\t * @param request  the request\n\t * @param response the response\n\t *\n\t * @return the authentication\n\t *\n\t * @throws AuthenticationException the authentication exception\n\t */\n\t@Override\n\tpublic Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)\n\t\t\tthrows AuthenticationException {\n\t\tif (postOnly && !POST.equals(request.getMethod())) {\n\t\t\tthrow new AuthenticationServiceException(\"Authentication method not supported: \" + request.getMethod());\n\t\t}\n\n\t\tString openid = obtainOpenId(request);\n\t\tString providerId = obtainProviderId(request);\n\n\t\tif (openid == null) {\n\t\t\topenid = \"\";\n\t\t}\n\t\tif (providerId == null) {\n\t\t\tproviderId = \"\";\n\t\t}\n\n\t\topenid = openid.trim();\n\t\tproviderId = providerId.trim();\n\n\t\tOpenIdAuthenticationToken authRequest = new OpenIdAuthenticationToken(openid, providerId);\n\n\t\t// Allow subclasses to set the \"details\" property","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-common/paascloud-security-app/src/main/java/com/paascloud/security/app/authentication/openid/OpenIdAuthenticationFilter.java#L48-L84","documentation":"OpenIdAuthenticationFilter.attemptAuthentication throws AuthenticationServiceException('Authentication method not supported: ' + method) when the openid login request arrives with an HTTP method other than POST while postOnly is enabled. The filter only accepts form-submitted POST requests carrying openid and providerId parameters.","triggerScenarios":"Sending a GET request to the openid auth processing URL (default /auth/openid) with postOnly=true (the default). E.g. calling the endpoint from a browser address bar, a curl GET, or a link/redirect instead of a form POST.","commonSituations":"Testing the endpoint manually with GET; frontend performing a redirect instead of a form submit; misconfigured client issuing HEAD/PUT to the auth URL; API gateway rewriting POST to GET on redirect.","solutions":["Send the openid authentication request as an HTTP POST with openid and providerId parameters.","If GET access is intentionally required, construct OpenIdAuthenticationFilter with postOnly=false.","Check client code/redirect chain so the auth URL is not reached via GET redirect.","Verify the security config maps the correct request matcher URL to this filter."],"exampleFix":"// before\ncurl 'http://host/auth/openid?openid=o123&providerId=weixin'\n// after\ncurl -X POST 'http://host/auth/openid' -d 'openid=o123' -d 'providerId=weixin'","handlingStrategy":"validation","validationCode":"if (request.getMethod() != null && !\"POST\".equalsIgnoreCase(request.getMethod())) {\n    throw new IllegalArgumentException(\"openid login must be POST\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Authentication result = filter.attemptAuthentication(request, response);\n} catch (AuthenticationServiceException e) {\n    response.sendError(HttpServletResponse.SC_METHOD_NOT_ALLOWED, \"Use POST\");\n}","preventionTips":["Always POST openid credentials as form parameters.","Keep postOnly=true in production to reject GET probing.","Test the auth endpoint with POST only in curl/Postman."],"tags":["java","spring-security","http-method","authentication"],"backgroundTag":"http-method-not-allowed","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}