wuyouzhuguli/SpringAll · warning · AuthenticationServiceException

Authentication method not supported: {method}

Error message

Authentication method not supported: {method}

What it means

Thrown by SmsAuthenticationFilter.attemptAuthentication as an AuthenticationServiceException when postOnly is true (default) and the request to /login/mobile is not a POST. The filter is constructed with AntPathRequestMatcher("/login/mobile","POST"), so only POST reaches it; a GET/PUT/etc. is rejected before any credential processing.

Source

Thrown at 59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsAuthenticationFilter.java:29

import javax.servlet.http.HttpServletResponse;

public class SmsAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    public static final String MOBILE_KEY = "mobile";

    private String mobileParameter = MOBILE_KEY;
    private boolean postOnly = true;


    public SmsAuthenticationFilter() {
        super(new AntPathRequestMatcher("/login/mobile", "POST"));
    }


    public Authentication attemptAuthentication(HttpServletRequest request,
                                                HttpServletResponse response) throws AuthenticationException {
        if (postOnly && !request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }

        String mobile = obtainMobile(request);

        if (mobile == null) {
            mobile = "";
        }

        mobile = mobile.trim();

        SmsAuthenticationToken authRequest = new SmsAuthenticationToken(mobile);

        setDetails(request, authRequest);

        return this.getAuthenticationManager().authenticate(authRequest);
    }

View on GitHub (pinned to 614d2578d9)

Solutions

1. Send the mobile-login request as an HTTP POST to /login/mobile.
2. Verify the form tag has method="post" and the AJAX call uses method:'POST'.
3. If non-POST is genuinely required, set postOnly=false on the filter (not recommended for security).
4. Check proxy/redirect rules that might rewrite POST to GET.

Example fix

// before
fetch('/login/mobile?mobile=13800000000');

// after
fetch('/login/mobile', { method: 'POST', body: new URLSearchParams({mobile:'13800000000'}) });

// client-side: always POST to /login/mobile
if (method !== 'POST') { throw new Error('mobile login must be POST'); }

// catch AuthenticationServiceException and inform client to use POST
try { ... } catch (AuthenticationServiceException e) { res.sendError(405, e.getMessage()); }

When it happens

Trigger: A client sends GET (or PUT/DELETE) to /login/mobile; a browser navigating to the URL directly; a misconfigured form without method="post"; an API client defaulting to GET.

Common situations: Form missing method="post"; curl/AJAX call without specifying method; redirect or link that performs a GET; integration test using the wrong verb.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication method not supported: {method}
• Authentication method not supported: {}
• 未找到与该手机号对应的用户
• 未找到与该手机号对应的用户
• Authentication method not supported: {method}

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/87868fd03db03548. Report an issue: GitHub.