title: Spring w/ @EnableOAuth2Sso client tries to access /oauth/token via GET rather than POST
body: <p>I have a Spring Boot OAuth2 client &amp; a Spring Boot OAuth 2 ResourceServer that's also an Authorization Service. I know what the problem is. I know OAuth 2 tokens are not allowed via get, only Post. However, I'm at a loss on how to fix it. This seems to come automatically w/ <code>@EnableOAuth2Sso</code> built in. In the code below you can see that class is bare bones. I haven't seen in the <code>WebSecurityConfigurerAdapter</code> mentioning a way to deal w/ this.</p>
  
  <p>I'm not going to include the whole POM but I'm using Spring Boot 1.5.10.RELEASE which includes spring-security-oauth2-2.0.14.RELEASE</p>
  
  <p>I've included my classes &amp; properties files w/ client-id &amp; client-secret XXXed out, Client classes &amp; props first:</p>
  
  <p>Client application.properties:</p>
  
  <pre><code>server.port=7293
  server.context-path=/ui
  server.session.cookie.name=UISESSION
  
  security.basic.enabled=false
  
  security.oauth2.client.client-id=XXXXX
  security.oauth2.client.client-secret=XXXXX
  security.oauth2.client.access-token-uri=http://localhost:7291/auth/oauth/token
  security.oauth2.client.user-authorization-uri=http://localhost:7291/auth/oauth/token
  security.oauth2.resource.user-info-uri=http://localhost:7291/auth/user/me
  
  spring.thymeleaf.cache=false
  </code></pre>
  
  <p>Client Security Config:</p>
  
  <pre><code>@Configuration
  @EnableOAuth2Sso
  public class UISecurityConfig extends WebSecurityConfigurerAdapter {
  
     @Override
     public void configure(HttpSecurity http) throws Exception {
         http.antMatcher("/**")
           .authorizeRequests()
           .antMatchers("/", "/login**")
           .permitAll()
           .anyRequest()
           .authenticated();
     }    
  }
  </code></pre>
  
  <p>Client Spring Boot app class:</p>
  
  <pre><code>@SpringBootApplication
  public class OAuth2ClientApplication {
  
      public static void main(String[] args) {
          SpringApplication.run(OAuth2ClientApplication.class, args);
      }
  
      @Bean
      public RequestContextListener requestContextListener(){
          return new RequestContextListener();
      }   
  }
  </code></pre>
  
  <p>Resource/Authentication Server App classes:</p>
  
  <p>application.properties:</p>
  
  <pre><code>server.port=7291
  server.context-path=/auth
  
  security.oauth2.client.client-id=XXXXX
  security.oauth2.client.client-secret=XXXXX
  
  security.oauth2.authorization.checkTokenAccess=isAuthenticated()
  security.oauth2.authorization.token-key-access=permitAll()
  
  security.basic.enabled=false
  </code></pre>
  
  <p>Auth Server Configuration class:</p>
  
  <pre><code>@Configuration
  @EnableAuthorizationServer
  public class AuthServerConfig extends AuthorizationServerConfigurerAdapter {
  
      private static final Logger logger = LoggerFactory.getLogger(FilteringServiceAuthServerConfig.class);
  
      @Value("${security.oauth2.client.client-id}")
      private String clientId;
  
      @Value("${security.oauth2.client.client-secret}")
      private String clientSecret;
  
      @Autowired
      private AuthenticationManager authenticationManager;
  
      @Override
      public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
          clients.inMemory()
            .withClient(clientId)
            .secret(clientSecret)
            .authorizedGrantTypes("authorization_code")
            .scopes("user_info")
            .autoApprove(true) ; 
      }
  
      @Override
      public void configure(AuthorizationServerEndpointsConfigurer endpoints) throws Exception {
          endpoints.authenticationManager(authenticationManager);
      }
  }
  </code></pre>
  
  <p>and here's my Authorization Server Web Security Config class:</p>
  
  <pre><code>@Configuration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private AuthenticationManager authenticationManager;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          // @formatter:off
          http.requestMatchers()
            .antMatchers("/login", "/oauth/authorize", "/oauth/token")
            .and()
            .authorizeRequests()
            .anyRequest().authenticated()
            .and()
            .formLogin().permitAll();
          // @formatter:on
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.parentAuthenticationManager(authenticationManager)
              .inMemoryAuthentication()
              .withUser("XXXXX").password("XXXXX").roles("USER", "ADMIN");
      }
  }
  </code></pre>
  
  <p>and the Authorization / Resource Server combo Spring Boot Application class:</p>
  
  <pre><code>@SpringBootApplication
  @EnableResourceServer
  public class FilteringServiceApp extends SpringBootServletInitializer {
  
      private static Logger logger = LoggerFactory.getLogger(FilteringServiceApp.class);
  
      @Value("${matches.file.name}")
      private String fileName;
  
      @Autowired 
      private FilterMatchRepository matchRepo;
  
      @PostConstruct
      private void init() {
          new MatchInitializer(matchRepo, fileName).init();
      }
  
      /**
       * Start up the Filter Matching Application
       * 
       * @param args 
       */
      public static void main(String[] args) {
          SpringApplication.run(FilteringServiceApp.class, args);
      }
  
      @Bean
      public RequestContextListener requestContextListener(){
          return new RequestContextListener();
      } 
  }
  </code></pre>
  
  <p>the error i get when I access the URL this way (after authenticating via client_id &amp; secret_id is:</p>
  
  <p>{
      "error": "method_not_allowed",
      "error_description": "Request method &#39;GET&#39; not supported"
  }</p>
  
  <p>i used NGrok to see what was happening as I got this error message &amp; you can see that it's clearly accessing /oauth/token via a GET request which is against the spec. here's that output:</p>
  
  <pre><code>HTTP/1.1 302 
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Pragma: no-cache
  Expires: 0
  X-Frame-Options: DENY
  Location: http://localhost:7291/auth/oauth/token?client_id=XXXXX&amp;redirect_uri=http://57bfa798.ngrok.io/ui/login&amp;response_type=code&amp;state=BgLGhq
  Content-Length: 0
  Date: Mon, 26 Feb 2018 09:42:30 GMT
  </code></pre>