title: Spring Boot - Multiple login pages with dynamically added paths - 405 'POST' not supported
body: <p>I've got a problem with my Spring Boot application in which im trying to implement dynamically configured multiple login pages. </p>
  
  <p>In the database are stored prefixes for pages and I'm trying to get multiple paths for separate login pages.</p>
  
  <p>I'm trying to do it in the following SecurityConfig class 
  (<em>global.getPath() returns a plain prefix String</em>):</p>
  
  <pre><code>@Configuration
  @EnableGlobalMethodSecurity( securedEnabled = true )
  @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      private GlobalSettingsService globalSettingsService;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          List&lt;GlobalSettings&gt; globals = globalSettingsService.findAll();
  
          http
                  .authorizeRequests()
                      .antMatchers("/css/**", "/index").permitAll()
                      .antMatchers("/js/**", "/").permitAll()
                      .antMatchers("/fonts/**", "/img/**").permitAll();
          for (GlobalSettings global : globals) {
              http.authorizeRequests()
                 .antMatchers("/"+global.getPath()+"/**").permitAll()
                 .antMatchers("/"+global.getPath()+"/admin/**").hasAnyRole("USER","ADMIN")
                  .and()
                  .formLogin().loginProcessingUrl("/"+global.getPath()+"/login")
                      .loginPage("/"+global.getPath()+"/login").permitAll()
                      .defaultSuccessUrl("/"+global.getPath()+"/admin")
                  .failureUrl("/"+global.getPath()+"/login?error").permitAll()
                  .and()
                  .logout()
                      .logoutRequestMatcher(new AntPathRequestMatcher("/"+global.getPath()+"/login?logout"))
                      .logoutSuccessUrl("/"+global.getPath()+"/login?logout")
                      .permitAll();
          }
      }
  }
  </code></pre>
  
  <p>Login forms views are configured in another class (WebConfig) which extends WebMvcConfigureAdapter:</p>
  
  <pre><code>for (GlobalSettings global : globals) {
              registry.addViewController("/"+global.getPath()+"/login").setViewName(global.getPath()+"-/login-form");
          }
  </code></pre>
  
  <p>I've got 3 prefixes to configure and the last one configured in the loop is working correctly (propably with the highest order?) - I can log in and out without any troubles.</p>
  
  <p>So the configuration works only for the last prefix which is called in the loop. Other prefixes are rendering proper login forms but returning 405 code after login attempt with following message:</p>
  
  <pre><code>o.s.web.servlet.PageNotFound: Request method 'POST' not supported
  </code></pre>
  
  <p>So I made custom POST method definition in one of my controllers:</p>
  
  <pre><code>@RequestMapping(value = "/{path}/login", method = RequestMethod.POST)
  public ModelAndView getLoginPage(@PathVariable("path") String path, @RequestParam Optional&lt;String&gt; error) {
          return new ModelAndView(path+"-front/login-form", "error", error);
  }
  </code></pre>
  
  <p>But unfortunately it's not being recognized, still getting 'Method not supported' message, while the login request path is correct.</p>
  
  <p>Besides, the paths are mapping correctly during application initialization so I don't know where the problem is.
  I tried many ways such as adding hidden _csrf field to the login form and still getting nothing.</p>
  
  <p>Is it possible to do it avoiding prefixes hardcoding? 
  Is it related with @Order annotation or something like this?</p>
  
  <p>Thanks for your time</p>