title: Spring Security - 405 Request Method 'POST' Not Supported
body: <p>I have implemented Spring Security to my project, but I am getting status 405 when I try to log in. I have already added <code>csrf</code> token in the <code>form</code>.</p>
  
  <p>This is the error I am getting when I send username and password: 
  <code>HTTP Status 405 - Request method 'POST' not supported</code></p>
  
  <p>Spring version: 4.0.2.RELEASED</p>
  
  <pre><code>&lt;div class="login-form"&gt;
      &lt;c:url var="loginUrl" value="/login" /&gt;
      &lt;form action="${loginUrl}" method="post" class="form-horizontal"&gt;
          &lt;c:if test="${param.error != null}"&gt;
              &lt;div class="alert alert-danger"&gt;
                  &lt;p&gt;Invalid username and password.&lt;/p&gt;
              &lt;/div&gt;
          &lt;/c:if&gt;
          &lt;c:if test="${param.logout != null}"&gt;
              &lt;div class="alert alert-success"&gt;
                  &lt;p&gt;You have been logged out successfully.&lt;/p&gt;
              &lt;/div&gt;
          &lt;/c:if&gt;
          &lt;div class="input-group input-sm"&gt;
              &lt;label class="input-group-addon" for="username"&gt;
                  &lt;i class="fa fa-user"&gt;&lt;/i&gt;
              &lt;/label&gt;
              &lt;input type="text" class="form-control" id="username"
                  name="clientusername" placeholder="Enter Username" required&gt;
          &lt;/div&gt;
          &lt;div class="input-group input-sm"&gt;
              &lt;label class="input-group-addon" for="password"&gt;
                  &lt;i class="fa fa-lock"&gt;&lt;/i&gt;
              &lt;/label&gt;
              &lt;input type="password" class="form-control" id="password"
                  name="clientpassword" placeholder="Enter Password" required&gt;
          &lt;/div&gt;
  
          &lt;input type="hidden" name="${_csrf.parameterName}"
              value="${_csrf.token}" /&gt;
  
          &lt;div class="form-actions"&gt;
              &lt;input type="submit" class="btn btn-block btn-primary btn-default"
                  value="Log in"&gt;
          &lt;/div&gt;
      &lt;/form&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>Security Configuration: </p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Autowired
      @Qualifier("G2BUserDetailsService")
      UserDetailsService userDetailsService;
  
      @Autowired
      public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
          auth.userDetailsService(userDetailsService);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
          .antMatchers("/", "/home").permitAll()
          .antMatchers("/admin/**").access("hasRole('ADMIN')")
          .and().formLogin().loginPage("/login")
          .usernameParameter("clientusername").passwordParameter("clientpassword")
          .and().csrf()
          .and().exceptionHandling().accessDeniedPage("/Access_Denied");
  //        .and().csrf().disable();
      }
  </code></pre>
  
  <p>Controller: </p>
  
  <pre><code>@RequestMapping(value = "/login", method = RequestMethod.GET)
  public ModelAndView loginPage() {
      return new ModelAndView("login");
  }
  
  @RequestMapping(value="/logout", method = RequestMethod.GET)
  public String logoutPage (HttpServletRequest request, HttpServletResponse response) {
      Authentication auth = SecurityContextHolder.getContext().getAuthentication();
      if (auth != null){    
          new SecurityContextLogoutHandler().logout(request, response, auth);
      }
      return "redirect:/login?logout";
  }
  
   @RequestMapping(value = "/Access_Denied", method = RequestMethod.GET)
      public ModelAndView accessDeniedPage(ModelMap model) {
          model.addAttribute("user", getPrincipal());
          return new ModelAndView("accessDenied");
      }
  
   @RequestMapping(value = "/admin", method = RequestMethod.GET)
      public ModelAndView adminPage(ModelMap model) {
          model.addAttribute("user", getPrincipal());
          return new ModelAndView("admin");
      }
  
   private String getPrincipal(){
          String userName = null;
          Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
  
          if (principal instanceof UserDetails) {
              userName = ((UserDetails)principal).getUsername();
          } else {
              userName = principal.toString();
          }
          return userName;
      }
  </code></pre>
  
  <p>Almost every topic about this issue says that we need to add <code>csrf</code> token, but I already added. Am I missing something?</p>