title: Spring Security 4 : Request method 'POST' not supported
body: <p>The issue is that when I click on submit I get</p>
  
  <pre><code>Etat HTTP 405 - Request method 'POST' not supported
  </code></pre>
  
  <p>Here is the controller :</p>
  
  <pre><code>@RequestMapping(value = "/admin/login", method = RequestMethod.GET)
  public ModelAndView login(
          @RequestParam(value = "error", required = false) String error,
          @RequestParam(value = "logout", required = false) String logout) {
      LOGGER.debug("admin login page");
      ModelAndView model = new ModelAndView();
      if (error != null) {
          model.addObject("error", "Invalid username and password!");
      }
  
      if (logout != null) {
          model.addObject("msg", "You've been logged out successfully.");
      }
  
      model.setViewName("/admin/index");
      LOGGER.debug("returning admin login page");
  
      return model;
  }
  </code></pre>
  
  <p>And the form :</p>
  
  <pre><code>&lt;form class="m-t" role="form" th:action="@{/admin/login}" method="POST" autocomplete="off"&gt;
      &lt;div th:if="${param.error}" class="alert alert-danger"&gt;Invalid username and password.&lt;/div&gt;
      &lt;div th:if="${param.logout}" class="alert alert-success"&gt;You have been logged out.&lt;/div&gt;
      &lt;div class="form-group"&gt;
          &lt;input type="text" class="form-control" id="username" name="username" placeholder="Username" required="" /&gt;
      &lt;/div&gt;
      &lt;div class="form-group"&gt;
          &lt;input type="password" class="form-control" id="username" name="username" placeholder="Username" required="" /&gt;
      &lt;/div&gt;
      &lt;input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" /&gt;
      &lt;button type="submit" class="btn btn-primary block full-width m-b"&gt;Login&lt;/button&gt;
      &lt;a href="#"&gt;&lt;small&gt;Forgot password?&lt;/small&gt;&lt;/a&gt;
      &lt;p class="text-muted text-center"&gt;
          &lt;small&gt;Do not have an account?&lt;/small&gt;
      &lt;/p&gt;
      &lt;a class="btn btn-sm btn-white btn-block" href="register.html"&gt;Create an account&lt;/a&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>It seems like csrf field not working.</p>
  
  <p>I explain, I have normal users website which I refer here by   and admin part which is /admin</p>
  
  <p>The login form is correctly displayed. But I when I click submit I get Etat <code>HTTP 405 - Request method 'POST' not supported</code></p>
  
  <p>Any idea please ?</p>
  
  <p>Here is my security configuration class :</p>
  
  <pre><code>package com.mintad.spring.security;
  
  import javax.sql.DataSource;
  
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.beans.factory.annotation.Qualifier;
  import org.springframework.context.annotation.ComponentScan;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.core.userdetails.UserDetailsService;
  
  /**
   * @author Sofiane HAMMAMI
   */
  @Configuration
  @EnableWebSecurity
  @ComponentScan
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Autowired
      DataSource dataSource;
  
      @Autowired
      @Qualifier("customUserDetailsService")
      UserDetailsService userDetailsService;
  
      @Autowired
      public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userDetailsService);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
              .antMatchers("/", "/home").permitAll()
              .antMatchers("/admin/**").permitAll()
  //          .antMatchers("/admin/**").access("hasRole('ADMIN')")
              .and().formLogin().loginPage("/login")
              .defaultSuccessUrl("/welcome").usernameParameter("username").passwordParameter("password")
              .and().exceptionHandling().accessDeniedPage("/404");
      }
  }
  </code></pre>