title: Spring returns HTTP 405 for every HTTP POST which isn't authorized
body: <p>It seems like Spring isn't routing/authorizing HTTP POST requests correctly. When I send a HTTP POST request I always get "405 Method Not Allowed" response and this in the log file:</p>
  
  <p>org.springframework.web.servlet.PageNotFound - Request method 'POST' not supported</p>
  
  <p>The controller allows POST for the URL:</p>
  
  <pre><code>@RequestMapping(value = "/mypostreq", method = RequestMethod.POST, consumes = MediaType.APPLICATION_JSON_VALUE)
  @Secured("ROLE_USER")
  public String mypostreq(@RequestBody String callBody, HttpServletRequest req, HttpServletResponse res) { return ""; }
  </code></pre>
  
  <p>Here is the web.xml configuration:</p>
  
  <pre><code>&lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;/WEB-INF/application-context.xml&lt;/param-value&gt;
  &lt;/context-param&gt;
  &lt;listener&gt;
      &lt;listener-class&gt;
          org.springframework.web.context.ContextLoaderListener
      &lt;/listener-class&gt;
  &lt;/listener&gt;
  &lt;servlet&gt;
      &lt;servlet-name&gt;dispatcherServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;/WEB-INF/web-context.xml&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;dispatcherServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>After I send a HTTP GET request I get the usual from HTTP GET -- 401 -- HTTP GET + Authorize -- 200 OK. At that point I use a cookie to authorize further requests. When sending authorized HTTP POSTs with a cookie everything works as expected. Basically I should get HTTP 401 response to the POSTs instead of 405.</p>
  
  <p>I suspect it is the routing, but cannot identify what exactly.</p>
  
  <p>Here is my web-context.xml</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:aop="http://www.springframework.org/schema/aop"
         xmlns:mvc="http://www.springframework.org/schema/mvc"
         xmlns:context="http://www.springframework.org/schema/context"
         xmlns:security="http://www.springframework.org/schema/security"
         xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                             http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd
                             http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
                             http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
                             http://www.springframework.org/schema/aop  http://www.springframework.org/schema/aop/spring-aop-3.0.xsd"&gt;
  
      &lt;mvc:annotation-driven/&gt;
      &lt;context:annotation-config/&gt;
      &lt;context:component-scan base-package="com.solution"/&gt;
  
      &lt;bean class="org.springframework.web.servlet.view.InternalResourceViewResolver"&gt;
          &lt;property name="prefix" value="/WEB-INF/error/" /&gt;
          &lt;property name="suffix" value=".jsp" /&gt;
      &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>And the application-context.xml</p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:security="http://www.springframework.org/schema/security"
         xmlns:couchdb="http://www.ektorp.org/schema/couchdb"
         xmlns:util="http://www.springframework.org/schema/util"
         xmlns:context="http://www.springframework.org/schema/context"
         xmlns:cache="http://www.springframework.org/schema/cache"
         xmlns:p="http://www.springframework.org/schema/p"
         xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                             http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
                             http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
                             http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
                             http://www.springframework.org/schema/cache http://www.springframework.org/schema/cache/spring-cache.xsd"&gt;
  
      &lt;security:http entry-point-ref="digestEntryPoint"&gt;
          &lt;security:custom-filter ref="digestFilter" before="BASIC_AUTH_FILTER"/&gt;
          &lt;security:http-basic /&gt;
          &lt;!-- Restricts anonymous access to all the pages --&gt;
          &lt;security:intercept-url pattern="/clientapi/content*/sound/**" access="" /&gt; 
          &lt;security:intercept-url pattern="/clientapi/currentcall" access="ROLE_USER" /&gt;
      &lt;/security:http&gt;
  
      &lt;security:authentication-manager&gt;
          &lt;security:authentication-provider ref="daoAuthenticationProvider"/&gt;
      &lt;/security:authentication-manager&gt;
  
      &lt;bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
          &lt;property name="userDetailsService" ref="solutionUserDetailsService"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- Digest authentication --&gt;
      &lt;bean id="digestFilter" class="org.springframework.security.web.authentication.www.DigestAuthenticationFilter"&gt;
          &lt;property name="userDetailsService" ref="solutionUserDetailsService"/&gt;
          &lt;property name="authenticationEntryPoint" ref="digestEntryPoint"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="digestEntryPoint" class="org.springframework.security.web.authentication.www.DigestAuthenticationEntryPoint"&gt;
          &lt;property name="realmName" value="Labs solution"/&gt;
          &lt;property name="key" value="asdfasdf"/&gt;
          &lt;property name="nonceValiditySeconds" value="10"/&gt;
      &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>Request/Response looks like this:</p>
  
  <pre><code>POST https://1.1.1.1/Solution-1.0/clientapi/currentcall HTTP/1.1
  Accept: application/json
  Content-Type: application/json
  Host: 1.1.1.1
  Content-Length: 82
  Expect: 100-continue
  Connection: Keep-Alive
  
  { "action" : "start" }
  
  
  
  HTTP/1.1 405 Method Not Allowed
  Server: SolutionServer
  Date: Thu, 05 Sep 2013 08:03:36 GMT
  Transfer-Encoding: chunked
  Connection: keep-alive
  Set-Cookie: JSESSIONID=B2A5F1FAC6E9JSNF4E62C4F9CBA24F38; Path=/Solution-1.0/; Secure; HttpOnly
  WWW-Authenticate: Digest realm="Labs Solution", qop="auth", nonce="MTM3ODMMKS8yNjA3MDpjNDczNGJhYWJjYThkMGE4NTZkNmRiOGRjZWIwNDE5NQ=="
  Allow: GET
  
  0
  </code></pre>