wuyouzhuguli/SpringAll · warning · AuthenticationServiceException

Authentication method not supported: {method}

Error message

Authentication method not supported: {method}

What it means

Thrown by SmsAuthenticationFilter.attemptAuthentication (Logout project) as AuthenticationServiceException when postOnly is true and the request to /login/mobile is not a POST. The filter is bound to AntPathRequestMatcher("/login/mobile","POST").

Source

Thrown at 60.Spring-Security-Logout/src/main/java/cc/mrbird/validate/smscode/SmsAuthenticationFilter.java:29

import javax.servlet.http.HttpServletResponse;

public class SmsAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    public static final String MOBILE_KEY = "mobile";

    private String mobileParameter = MOBILE_KEY;
    private boolean postOnly = true;


    public SmsAuthenticationFilter() {
        super(new AntPathRequestMatcher("/login/mobile", "POST"));
    }


    public Authentication attemptAuthentication(HttpServletRequest request,
                                                HttpServletResponse response) throws AuthenticationException {
        if (postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }

        String mobile = obtainMobile(request);

        if (mobile == null) {
            mobile = "";
        }

        mobile = mobile.trim();

        SmsAuthenticationToken authRequest = new SmsAuthenticationToken(mobile);

        setDetails(request, authRequest);

        return this.getAuthenticationManager().authenticate(authRequest);
    }

View on GitHub (pinned to 614d2578d9)

Solutions

1. Send the mobile-login request as HTTP POST to /login/mobile.
2. Ensure the form uses method="post" and AJAX uses method:'POST'.
3. Set postOnly=false only if non-POST is truly required (security trade-off).
4. Check proxy rules that rewrite POST to GET.

Example fix

// before
fetch('/login/mobile?mobile=13800000000');

// after
fetch('/login/mobile', { method:'POST', body:new URLSearchParams({mobile:'13800000000'}) });

// client-side: always POST to /login/mobile
if (method !== 'POST') { throw new Error('mobile login must be POST'); }

// catch AuthenticationServiceException; respond 405 and instruct client to use POST.

When it happens

Trigger: A GET/PUT/DELETE to /login/mobile; a form without method="post"; a browser navigation; an API client defaulting to GET.

Common situations: Form missing method; curl without -X POST; redirect rewriting POST to GET; wrong verb in tests.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication method not supported: {method}
• Authentication method not supported: {}
• 未找到与该手机号对应的用户
• 未找到与该手机号对应的用户
• Authentication method not supported: {method}

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/ee7b68b36fee9a0b. Report an issue: GitHub.