title: HTTP Status 405 - Request method 'POST' not supported - Spring Security
body: <p>I get the below error when I try to implement Spring security -</p>
  <p>controller:</p>
  <pre><code>@Controller
  public class EmployeeController {
  
      @RequestMapping(value = { &quot;/&quot;, &quot;/welcome**&quot; }, method = RequestMethod.GET)
      public ModelAndView defaultPage() {
  
          ModelAndView model = new ModelAndView();
          model.addObject(&quot;title&quot;, &quot;Spring Security + Hibernate Example&quot;);
          model.addObject(&quot;message&quot;, &quot;This is default page!&quot;);
          model.setViewName(&quot;hello&quot;);
          return model;
      }
  
      @RequestMapping(value = &quot;/admin**&quot;, method = RequestMethod.GET)
      public ModelAndView adminPage() {
  
          ModelAndView model = new ModelAndView();
          model.addObject(&quot;title&quot;, &quot;Spring Security + Hibernate Example&quot;);
          model.addObject(&quot;message&quot;, &quot;This page is for ROLE_ADMIN only!&quot;);
          model.setViewName(&quot;admin&quot;);
  
          return model;
      }
  
      @RequestMapping(value = &quot;/login&quot;, method = RequestMethod.GET)
      public ModelAndView login(
              @RequestParam(value = &quot;error&quot;, required = false) String error,
              @RequestParam(value = &quot;logout&quot;, required = false) String logout,
              HttpServletRequest request) {
  
          ModelAndView model = new ModelAndView();
          if (error != null) {
              model.addObject(&quot;error&quot;,
                      getErrorMessage(request, &quot;SPRING_SECURITY_LAST_EXCEPTION&quot;));
          }
  
          if (logout != null) {
              model.addObject(&quot;msg&quot;, &quot;You've been logged out successfully.&quot;);
          }
          model.setViewName(&quot;login&quot;);
  
          return model;
      }
  
      // customize the error message
      private String getErrorMessage(HttpServletRequest request, String key) {
  
          Exception exception = (Exception) request.getSession()
                  .getAttribute(key);
  
          String error = &quot;&quot;;
          if (exception instanceof BadCredentialsException) {
              error = &quot;Invalid username and password!&quot;;
          } else if (exception instanceof LockedException) {
              error = exception.getMessage();
          } else {
              error = &quot;Invalid username and password!&quot;;
          }
          return error;
      }
  
      // for 403 access denied page
      @RequestMapping(value = &quot;/403&quot;, method = RequestMethod.GET)
      public ModelAndView accesssDenied() {
  
          ModelAndView model = new ModelAndView();
  
          // check if user is login
          Authentication auth = SecurityContextHolder.getContext()
                  .getAuthentication();
          if (!(auth instanceof AnonymousAuthenticationToken)) {
              UserDetails userDetail = (UserDetails) auth.getPrincipal();
              System.out.println(userDetail);
  
              model.addObject(&quot;username&quot;, userDetail.getUsername());
          }
  
          model.setViewName(&quot;403&quot;);
          return model;
      }
  }
  </code></pre>
  <p>web.xml</p>
  <pre><code>&lt;!DOCTYPE web-app PUBLIC
   &quot;-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN&quot;
   &quot;http://java.sun.com/dtd/web-app_2_3.dtd&quot; &gt;
  
  &lt;web-app&gt;
      &lt;display-name&gt;Archetype Created Web Application&lt;/display-name&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;servlet-class&gt;
              org.springframework.web.servlet.DispatcherServlet
          &lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  
      &lt;listener&gt;
          &lt;listener-class&gt;
              org.springframework.web.context.ContextLoaderListener
          &lt;/listener-class&gt;
      &lt;/listener&gt;
      
      &lt;context-param&gt;
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
          &lt;param-value&gt;
              /WEB-INF/mvc-dispatcher-servlet.xml,
              /WEB-INF/spring-security.xml
          &lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;!-- /WEB-INF/spring-security.xml --&gt;
  
      &lt;!-- Spring Security --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>
  <p>Spring-security.xml</p>
  <pre><code>&lt;beans:beans xmlns=&quot;http://www.springframework.org/schema/security&quot;
      xmlns:beans=&quot;http://www.springframework.org/schema/beans&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot;
      xsi:schemaLocation=&quot;http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-3.2.xsd&quot;&gt;
  
      &lt;!-- enable use-expressions --&gt;
      &lt;http auto-config=&quot;true&quot; use-expressions=&quot;true&quot;&gt;
          &lt;intercept-url pattern=&quot;/admin**&quot; access=&quot;hasRole('ROLE_ADMIN')&quot; /&gt;
  
          &lt;!-- access denied page --&gt;
          &lt;access-denied-handler error-page=&quot;/403&quot; /&gt;
          &lt;form-login 
              login-page=&quot;/login&quot; 
              default-target-url=&quot;/welcome&quot;
              authentication-failure-url=&quot;/login?error&quot; 
              username-parameter=&quot;username&quot;
              password-parameter=&quot;password&quot; /&gt;
          &lt;logout logout-success-url=&quot;/login?logout&quot; /&gt;
          &lt;!-- enable csrf protection --&gt;
          &lt;csrf /&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider user-service-ref=&quot;myUserDetailsService&quot; &gt;
              &lt;password-encoder hash=&quot;bcrypt&quot; /&gt;    
          &lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  <p>login.jsp</p>
  <pre><code>&lt;body onload='document.loginForm.username.focus();'&gt;
  
      &lt;h1&gt;Spring Security Login Form (Database + Hibernate Authentication)&lt;/h1&gt;
  
      &lt;div id=&quot;login-box&quot;&gt;
  
          &lt;h3&gt;Login with Username and Password&lt;/h3&gt;
  
          &lt;c:if test=&quot;${not empty error}&quot;&gt;
              &lt;div class=&quot;error&quot;&gt;${error}&lt;/div&gt;
          &lt;/c:if&gt;
          &lt;c:if test=&quot;${not empty msg}&quot;&gt;
              &lt;div class=&quot;msg&quot;&gt;${msg}&lt;/div&gt;
          &lt;/c:if&gt;
  
          &lt;form name='loginForm'
              action=&quot;&lt;c:url value='/j_spring_security_check' /&gt;&quot; method='POST'&gt;
  
              &lt;table&gt;
                  &lt;tr&gt;
                      &lt;td&gt;User:&lt;/td&gt;
                      &lt;td&gt;&lt;input type='text' name='username'&gt;&lt;/td&gt;
                  &lt;/tr&gt;
                  &lt;tr&gt;
                      &lt;td&gt;Password:&lt;/td&gt;
                      &lt;td&gt;&lt;input type='password' name='password' /&gt;&lt;/td&gt;
                  &lt;/tr&gt;
                  &lt;tr&gt;
                      &lt;td colspan='2'&gt;&lt;input name=&quot;submit&quot; type=&quot;submit&quot;
                          value=&quot;submit&quot; /&gt;&lt;/td&gt;
                  &lt;/tr&gt;
              &lt;/table&gt;
  
              &lt;input type=&quot;hidden&quot; name=&quot;${_csrf.parameterName}&quot;
                  value=&quot;${_csrf.token}&quot; /&gt;
  
          &lt;/form&gt;
      &lt;/div&gt;
  
  &lt;/body&gt;
  </code></pre>
  <p><strong>Error:-</strong></p>
  <p>http://localhost:8080/EmployeeManagement/j_spring_security_check</p>
  <pre><code>09:01:22.135 [http-8080-4] DEBUG o.s.s.web.DefaultRedirectStrategy - Redirecting to 'http://localhost:8080/EmployeeManagement/login;jsessionid=E27C22793BAA2C7FC38039260EC08152'
      09:01:22.135 [http-8080-4] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
      09:01:22.136 [http-8080-4] DEBUG o.s.s.w.c.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed
      09:01:22.145 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 1 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
      09:01:22.145 [http-8080-4] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - HttpSession returned null object for SPRING_SECURITY_CONTEXT
      09:01:22.145 [http-8080-4] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@48842f5e. A new one will be created.
      09:01:22.145 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 2 of 11 in additional filter chain; firing Filter: 'CsrfFilter'
      09:01:22.146 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 3 of 11 in additional filter chain; firing Filter: 'LogoutFilter'
      09:01:22.146 [http-8080-4] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Request 'GET /login' doesn't match 'POST /j_spring_security_logout
      09:01:22.146 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 4 of 11 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
      09:01:22.146 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 5 of 11 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
      09:01:22.146 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
      09:01:22.146 [http-8080-4] DEBUG o.s.s.w.s.DefaultSavedRequest - pathInfo: both null (property equals)
      09:01:22.147 [http-8080-4] DEBUG o.s.s.w.s.DefaultSavedRequest - queryString: both null (property equals)
      09:01:22.147 [http-8080-4] DEBUG o.s.s.w.s.DefaultSavedRequest - requestURI: arg1=/EmployeeManagement/admin; arg2=/EmployeeManagement/login;jsessionid=E27C22793BAA2C7FC38039260EC08152 (property not equals)
      09:01:22.147 [http-8080-4] DEBUG o.s.s.w.s.HttpSessionRequestCache - saved request doesn't match
      09:01:22.147 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
      09:01:22.147 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
      09:01:22.147 [http-8080-4] DEBUG o.s.s.w.a.AnonymousAuthenticationFilter - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@6fa90ed4: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffc7f0c: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: E27C22793BAA2C7FC38039260EC08152; Granted Authorities: ROLE_ANONYMOUS'
      09:01:22.147 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter'
      09:01:22.148 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
      09:01:22.148 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
      09:01:22.148 [http-8080-4] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/login'; against '/admin**'
      09:01:22.148 [http-8080-4] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - Public object - authentication not attempted
      09:01:22.148 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /login reached end of additional filter chain; proceeding with original chain
      09:01:22.148 [http-8080-4] DEBUG o.s.web.servlet.DispatcherServlet - DispatcherServlet with name 'mvc-dispatcher' processing GET request for [/EmployeeManagement/login]
      09:01:22.149 [http-8080-4] DEBUG o.s.w.s.m.a.DefaultAnnotationHandlerMapping - Mapping [/login] to HandlerExecutionChain with handler [com.employeemgmt.controller.EmployeeController@18ba5047] and 1 interceptor
      09:01:22.150 [http-8080-4] DEBUG o.s.web.servlet.DispatcherServlet - Last-Modified value for [/EmployeeManagement/login] is: -1
      09:01:22.189 [http-8080-4] DEBUG o.s.w.b.a.s.HandlerMethodInvoker - Invoking request handler method: public org.springframework.web.servlet.ModelAndView com.employeemgmt.controller.EmployeeController.login(java.lang.String,java.lang.String,javax.servlet.http.HttpServletRequest)
      09:01:22.190 [http-8080-4] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Invoking afterPropertiesSet() on bean with name 'login'
      09:01:22.190 [http-8080-4] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'org.springframework.transaction.config.internalTransactionAdvisor'
      09:01:22.190 [http-8080-4] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor#0'
      09:01:22.190 [http-8080-4] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'org.springframework.transaction.config.internalTransactionAdvisor'
      09:01:22.190 [http-8080-4] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'org.springframework.aop.support.DefaultBeanFactoryPointcutAdvisor#0'
      09:01:22.190 [http-8080-4] DEBUG o.s.web.servlet.DispatcherServlet - Rendering view [org.springframework.web.servlet.view.JstlView: name 'login'; URL [/WEB-INF/pages/login.jsp]] in DispatcherServlet with name 'mvc-dispatcher'
      09:01:22.190 [http-8080-4] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'requestDataValueProcessor'
      09:01:22.190 [http-8080-4] DEBUG o.s.web.servlet.view.JstlView - Forwarding to resource [/WEB-INF/pages/login.jsp] in InternalResourceView 'login'
      09:01:22.279 [http-8080-4] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
      09:01:22.279 [http-8080-4] DEBUG o.s.web.servlet.DispatcherServlet - Successfully completed request
      09:01:22.279 [http-8080-4] DEBUG o.s.s.w.a.ExceptionTranslationFilter - Chain processed normally
      09:01:22.280 [http-8080-4] DEBUG o.s.s.w.c.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed
      09:01:23.967 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /j_spring_security_check at position 1 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
      09:01:23.967 [http-8080-4] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - HttpSession returned null object for SPRING_SECURITY_CONTEXT
      09:01:23.968 [http-8080-4] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade@48842f5e. A new one will be created.
      09:01:23.968 [http-8080-4] DEBUG o.s.security.web.FilterChainProxy - /j_spring_security_check at position 2 of 11 in additional filter chain; firing Filter: 'CsrfFilter'
      09:01:23.969 [http-8080-4] DEBUG o.s.security.web.csrf.CsrfFilter - Invalid CSRF token found for http://localhost:8080/EmployeeManagement/j_spring_security_check
      09:01:23.971 [http-8080-4] DEBUG o.s.web.servlet.DispatcherServlet - DispatcherServlet with name 'mvc-dispatcher' processing POST request for [/EmployeeManagement/403]
      09:01:23.971 [http-8080-4] DEBUG o.s.w.s.m.a.DefaultAnnotationHandlerMapping - Mapping [/403] to HandlerExecutionChain with handler [com.employeemgmt.controller.EmployeeController@18ba5047] and 1 interceptor
      09:01:23.982 [http-8080-4] DEBUG o.s.w.s.m.a.AnnotationMethodHandlerExceptionResolver - Resolving exception from handler [com.employeemgmt.controller.EmployeeController@18ba5047]: org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
      09:01:23.984 [http-8080-4] DEBUG o.s.w.s.m.a.ResponseStatusExceptionResolver - Resolving exception from handler [com.employeemgmt.controller.EmployeeController@18ba5047]: org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
      09:01:23.984 [http-8080-4] DEBUG o.s.w.s.m.s.DefaultHandlerExceptionResolver - Resolving exception from handler [com.employeemgmt.controller.EmployeeController@18ba5047]: org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported
      09:01:23.984 [http-8080-4] WARN  o.s.web.servlet.PageNotFound - Request method 'POST' not supported
      09:01:23.984 [http-8080-4] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
      09:01:23.984 [http-8080-4] DEBUG o.s.web.servlet.DispatcherServlet - Null ModelAndView returned to DispatcherServlet with name 'mvc-dispatcher': assuming HandlerAdapter completed request handling
      09:01:23.984 [http-8080-4] DEBUG o.s.web.servlet.DispatcherServlet - Successfully completed request
      09:01:23.984 [http-8080-4] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
      09:01:23.984 [http-8080-4] DEBUG o.s.s.w.c.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed
  </code></pre>