Spring Security 4 : Request method 'POST' not supported

Question

The issue is that when I click on submit I get

Etat HTTP 405 - Request method 'POST' not supported

Here is the controller :

@RequestMapping(value = "/admin/login", method = RequestMethod.GET)
public ModelAndView login(
        @RequestParam(value = "error", required = false) String error,
        @RequestParam(value = "logout", required = false) String logout) {
    LOGGER.debug("admin login page");
    ModelAndView model = new ModelAndView();
    if (error != null) {
        model.addObject("error", "Invalid username and password!");
    }

    if (logout != null) {
        model.addObject("msg", "You've been logged out successfully.");
    }

    model.setViewName("/admin/index");
    LOGGER.debug("returning admin login page");

    return model;
}

And the form :

<form class="m-t" role="form" th:action="@{/admin/login}" method="POST" autocomplete="off">
    <div th:if="${param.error}" class="alert alert-danger">Invalid username and password.</div>
    <div th:if="${param.logout}" class="alert alert-success">You have been logged out.</div>
    <div class="form-group">
        <input type="text" class="form-control" id="username" name="username" placeholder="Username" required="" />
    </div>
    <div class="form-group">
        <input type="password" class="form-control" id="username" name="username" placeholder="Username" required="" />
    </div>
    <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
    <button type="submit" class="btn btn-primary block full-width m-b">Login</button>
    <a href="#"><small>Forgot password?</small></a>
    <p class="text-muted text-center">
        <small>Do not have an account?</small>
    </p>
    <a class="btn btn-sm btn-white btn-block" href="register.html">Create an account</a>
</form>

It seems like csrf field not working.

I explain, I have normal users website which I refer here by and admin part which is /admin

The login form is correctly displayed. But I when I click submit I get Etat HTTP 405 - Request method 'POST' not supported

Any idea please ?

Here is my security configuration class :

package com.mintad.spring.security;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;

/**
 * @author Sofiane HAMMAMI
 */
@Configuration
@EnableWebSecurity
@ComponentScan
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    DataSource dataSource;

    @Autowired
    @Qualifier("customUserDetailsService")
    UserDetailsService userDetailsService;

    @Autowired
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/", "/home").permitAll()
            .antMatchers("/admin/**").permitAll()
//          .antMatchers("/admin/**").access("hasRole('ADMIN')")
            .and().formLogin().loginPage("/login")
            .defaultSuccessUrl("/welcome").usernameParameter("username").passwordParameter("password")
            .and().exceptionHandling().accessDeniedPage("/404");
    }
}

Answer 1

In controller , you defined the form as GET:

@RequestMapping(value = "/admin/login", method = RequestMethod.GET)

and in the form, you are calling it as POST:

form class="m-t" role="form" th:action="@{/admin/login}" method="POST"

change one of these, either at controller or in the form.

If you want to change at controller, replace existing line with:

@RequestMapping(value = "/admin/login", method = RequestMethod.POST)

or you can do it by modifying call from form like

form class="m-t" role="form" th:action="@{/admin/login}" method="GET"