title: Failed to create WebSocket connection when Spring Security is on
body: <p>Im using Java WebSocket client that subscribe to a Spring-Boot based server application. 
  Everything worked just fine, but after adding support for Spring Security in order to authenticate and authorize users, the WebSocket Java client stopped working.
  Im getting the following errors (POST request failed with 405 Not Allowed error)</p>
  
  <pre><code>19:56:49.813 [main] INFO  o.s.s.c.ThreadPoolTaskScheduler -
  Initializing ExecutorService  19:56:49.819 [main] DEBUG
  StompWebSocketTestClient - Connecting and subscribing 1 users 
  19:56:49.886 [main] DEBUG o.s.w.s.s.c.RestTemplateXhrTransport -
  Executing SockJS Info request, url=http:&lt;//&gt;localhost:9090/hello/info
  19:56:49.923 [main] DEBUG o.s.web.client.RestTemplate - Created GET
  request for "http:&lt;//&gt;localhost:9090/hello/info" 19:56:49.941 [main]
  DEBUG o.s.web.client.RestTemplate - GET request for
  "http:&lt;//&gt;localhost:9090/hello/info" resulted in 200 (OK) 19:56:49.974
  [main] DEBUG o.s.w.s.s.client.WebSocketTransport - Starting WebSocket
  session
  url=ws:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/websocket
  19:56:49.974 [main] DEBUG o.s.w.s.c.s.StandardWebSocketClient -
  Connecting to
  ws:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/websocket
  19:56:50.120 [SimpleAsyncTaskExecutor-1] ERROR
  o.s.w.s.s.c.DefaultTransportRequest -
  TransportRequest[url=ws:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/websocket]
  failed. Falling back on next transport.
  javax.websocket.DeploymentException: The HTTP response from the server
  [HTTP/1.1 200 OK ] did not permit the HTTP upgrade to WebSocket     at
  org.apache.tomcat.websocket.WsWebSocketContainer.parseStatus(WsWebSocketContainer.java:619)
  ~[tomcat-embed-websocket-8.0.15.jar:8.0.15]     at
  org.apache.tomcat.websocket.WsWebSocketContainer.processResponse(WsWebSocketContainer.java:603)
  ~[tomcat-embed-websocket-8.0.15.jar:8.0.15]     at
  org.apache.tomcat.websocket.WsWebSocketContainer.connectToServer(WsWebSocketContainer.java:300)
  ~[tomcat-embed-websocket-8.0.15.jar:8.0.15]     at
  org.springframework.web.socket.client.standard.StandardWebSocketClient$1.call(StandardWebSocketClient.java:152)
  ~[spring-websocket-4.2.0.RC1.jar:4.2.0.RC1]     at
  org.springframework.web.socket.client.standard.StandardWebSocketClient$1.call(StandardWebSocketClient.java:149)
  ~[spring-websocket-4.2.0.RC1.jar:4.2.0.RC1]     at
  java.util.concurrent.FutureTask.run(FutureTask.java:266)
  ~[na:1.8.0_45]  at java.lang.Thread.run(Thread.java:745) [na:1.8.0_45]
  19:56:50.122 [SimpleAsyncTaskExecutor-1] DEBUG
  o.s.w.s.s.c.RestTemplateXhrTransport - Starting XHR Streamingsession
  url=http:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/xhr_streaming
  19:56:50.128 [SimpleAsyncTaskExecutor-1] DEBUG
  o.s.web.client.RestTemplate - Created POST request for
  "http:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/xhr_streaming"
  19:56:50.133 [SimpleAsyncTaskExecutor-1] WARN 
  o.s.web.client.RestTemplate - POST request for
  "http:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/xhr_streaming"
  resulted in 405 (Method Not Allowed); invoking error handler
  19:56:50.139 [SimpleAsyncTaskExecutor-1] ERROR
  o.s.w.s.s.c.DefaultTransportRequest -
  TransportRequest[url=http:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/xhr_streaming]
  failed. Falling back on next transport.
  org.springframework.web.client.HttpClientErrorException: 405 Method
  Not Allowed     at
  org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:91)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.handleResponseError(RestTemplate.java:615)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:573)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.execute(RestTemplate.java:544)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.socket.sockjs.client.RestTemplateXhrTransport$1.run(RestTemplateXhrTransport.java:128)
  ~[spring-websocket-4.2.0.RC1.jar:4.2.0.RC1]     at
  java.lang.Thread.run(Thread.java:745) [na:1.8.0_45] 19:56:50.140
  [SimpleAsyncTaskExecutor-1] DEBUG o.s.w.s.s.c.RestTemplateXhrTransport
  - Starting XHR Streamingsession url=http:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/xhr
  19:56:50.155 [SimpleAsyncTaskExecutor-2] DEBUG
  o.s.web.client.RestTemplate - Created POST request for
  "http:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/xhr"
  19:56:50.163 [SimpleAsyncTaskExecutor-2] WARN 
  o.s.web.client.RestTemplate - POST request for
  "http:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/xhr"
  resulted in 405 (Method Not Allowed); invoking error handler
  19:56:50.166 [SimpleAsyncTaskExecutor-2] ERROR
  o.s.w.s.s.c.DefaultTransportRequest - No more fallback transports
  after
  TransportRequest[url=http:&lt;//&gt;localhost:9090/hello/912/d93d47eb2bdd4700a26c0e19e10a33df/xhr]
  org.springframework.web.client.HttpClientErrorException: 405 Method
  Not Allowed     at
  org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:91)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.handleResponseError(RestTemplate.java:615)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:573)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.execute(RestTemplate.java:544)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.socket.sockjs.client.RestTemplateXhrTransport$1.run(RestTemplateXhrTransport.java:128)
  ~[spring-websocket-4.2.0.RC1.jar:4.2.0.RC1]     at
  java.lang.Thread.run(Thread.java:745) [na:1.8.0_45] 19:56:50.167
  [SimpleAsyncTaskExecutor-2] DEBUG o.s.m.simp.stomp.DefaultStompSession
  - Failed to connect session id=318180fa-47bc-5649-c136-db91a339837a org.springframework.web.client.HttpClientErrorException: 405 Method
  Not Allowed     at
  org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:91)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.handleResponseError(RestTemplate.java:615)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:573)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.execute(RestTemplate.java:544)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.socket.sockjs.client.RestTemplateXhrTransport$1.run(RestTemplateXhrTransport.java:128)
  ~[spring-websocket-4.2.0.RC1.jar:4.2.0.RC1]     at
  java.lang.Thread.run(Thread.java:745) [na:1.8.0_45] 19:56:50.170
  [SimpleAsyncTaskExecutor-2] ERROR StompWebSocketTestClient - Transport
  error org.springframework.web.client.HttpClientErrorException: 405
  Method Not Allowed  at
  org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:91)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.handleResponseError(RestTemplate.java:615)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:573)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.client.RestTemplate.execute(RestTemplate.java:544)
  ~[spring-web-4.1.3.RELEASE.jar:4.1.3.RELEASE]   at
  org.springframework.web.socket.sockjs.client.RestTemplateXhrTransport$1.run(RestTemplateXhrTransport.java:128)
  ~[spring-websocket-4.2.0.RC1.jar:4.2.0.RC1]     at
  java.lang.Thread.run(Thread.java:745) [na:1.8.0_45]
  </code></pre>
  
  <p>Here is the the Spring Security configuration file:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http.
              csrf().disable().
              sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).
              and().
              authorizeRequests().
              //TODO: as a workaround for WS 401 error, tried but did not work: antMatchers("/hello").permitAll(). possible related to the StompClient URL which is ws://
              antMatchers(actuatorEndpoints()).hasRole(backendAdminRole).
              anyRequest().authenticated().
              and().
              anonymous().disable().
              exceptionHandling().authenticationEntryPoint(unauthorizedEntryPoint());
  
      http.addFilterBefore(new AuthenticationFilter(authenticationManager()), BasicAuthenticationFilter.class).
              addFilterBefore(new ManagementEndpointAuthenticationFilter(authenticationManager()), BasicAuthenticationFilter.class);
  
  }
  </code></pre>
  
  <p>please note that I'm not using WebClient, thus my security configuration disable the Spring's default Spring LoginForm</p>
  
  <p>Here is the WebSocket configuration</p>
  
  <pre><code>@Override
  public void configureMessageBroker(MessageBrokerRegistry config) {
      config.enableSimpleBroker("/topic/");
      config.setApplicationDestinationPrefixes("/app");
  }
  
  @Override
  public void registerStompEndpoints(StompEndpointRegistry registry) {
      registry.addEndpoint("/hello").withSockJS();
  }
  </code></pre>
  
  <p>Here is the WebSocket Security configuration
  (I tried many configurations - tried everything I found in the web, but it didnt work)</p>
  
  <pre><code>@Override
  protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
      messages
              // message types other than MESSAGE and SUBSCRIBE
              .nullDestMatcher().authenticated()
              // matches any destination that starts with /rooms/
              .simpDestMatchers("/topic/**").authenticated()
              // (i.e. cannot send messages directly to /topic/, /queue/)
              // (i.e. cannot subscribe to /topic/messages/* to get messages sent to
              // /topic/messages-user&lt;id&gt;)
              .simpTypeMatchers(SimpMessageType.MESSAGE, SimpMessageType.SUBSCRIBE).denyAll()
              // catch all
              .anyMessage().denyAll();
  }
  
  /**
   * Disables CSRF for Websockets.
   */
  @Override
  protected boolean sameOriginDisabled() {
      return true;
  }
  </code></pre>
  
  <p>And here is my Java Client</p>
  
  <pre><code>    List&lt;Transport&gt; transports = new ArrayList&lt;&gt;(2);
  
      StandardWebSocketClient standardWebSocketClient = new StandardWebSocketClient();
      transports.add(new WebSocketTransport(standardWebSocketClient));
  
      RestTemplateXhrTransport restTemplateXhrTransport = new RestTemplateXhrTransport();
  
      //setting the authentication token
      HttpHeaders httpHeaders = new HttpHeaders();
      httpHeaders.add("X-Auth-Token", token);
  
      restTemplateXhrTransport.setRequestHeaders(httpHeaders);
      transports.add(restTemplateXhrTransport);
  
      SockJsClient sockJsClient = new SockJsClient(transports);
      WebSocketStompClient stompClient = new WebSocketStompClient(sockJsClient);
  
      ThreadPoolTaskScheduler taskScheduler = new ThreadPoolTaskScheduler();
      taskScheduler.afterPropertiesSet();
  
      String stompUrl = "ws://localhost:9090/hello";
  
  
      stompClient.setMessageConverter(new StringMessageConverter());
      stompClient.setTaskScheduler(taskScheduler);
      stompClient.setDefaultHeartbeat(new long[] {10, 10});
  
      WebSocketHttpHeaders headers = new WebSocketHttpHeaders(httpHeaders);
  
          WebSocketSession webSocketSession;
  
          logger.debug("Connecting and subscribing " + NUMBER_OF_USERS + " users ");
          StopWatch stopWatch = new StopWatch("STOMP Broker Relay WebSocket Load Tests");
          stopWatch.start();
  
          List&lt;ConsumerStompSessionHandler&gt; consumers = new ArrayList&lt;&gt;();
          for (int i=0; i &lt; NUMBER_OF_USERS; i++) {
              consumers.add(new ConsumerStompSessionHandler(BROADCAST_MESSAGE_COUNT, connectLatch,
                      subscribeLatch, messageLatch, disconnectLatch, failure));
              stompClient.connect(stompUrl, headers, consumers.get(i), host, port);
          }
  </code></pre>
  
  <p>The application failed on the stompClient.connect() line
  where:
  host is the address of the Web Application server (Spring base of course) - in my case is 'localhost'. The 'port' parameter is the port that the Web Application server is listening on.
  Headers: include 'X-Auth-Token' header</p>
  
  <p>Here is the current pom.xml I'm using (well, it changed a bit since I wrote the post)</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;project xmlns="http://maven.apache.org/POM/4.0.0"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"&gt;
      &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;
  
      &lt;parent&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
          &lt;version&gt;1.1.9.RELEASE&lt;/version&gt;
      &lt;/parent&gt;
  
      &lt;groupId&gt;my-group&lt;/groupId&gt;
      &lt;artifactId&gt;my.id&lt;/artifactId&gt;
      &lt;version&gt;1.0.0&lt;/version&gt;
  
      &lt;properties&gt;
  
          &lt;org.springframework-version&gt;4.1.3.RELEASE&lt;/org.springframework-version&gt;
  
          &lt;app.version&gt;1.0&lt;/app.version&gt;
          &lt;spring-boot.version&gt;1.1.3.RELEASE&lt;/spring-boot.version&gt;
  
          &lt;!-- Generic properties --&gt;
          &lt;java.version&gt;1.8&lt;/java.version&gt;
          &lt;project.build.sourceEncoding&gt;UTF-8&lt;/project.build.sourceEncoding&gt;
          &lt;project.reporting.outputEncoding&gt;UTF-8&lt;/project.reporting.outputEncoding&gt;
  
          &lt;!-- Logging
          &lt;logback.version&gt;1.0.13&lt;/logback.version&gt;
          &lt;slf4j.version&gt;1.7.5&lt;/slf4j.version&gt;--&gt;
          &lt;log4j.version&gt;1.2.17&lt;/log4j.version&gt;
  
          &lt;tomcat.version&gt;8.0.8&lt;/tomcat.version&gt;
  
          &lt;spring.version&gt;4.1.0.RELEASE&lt;/spring.version&gt;
  
          &lt;!-- Test --&gt;
          &lt;junit.version&gt;4.11&lt;/junit.version&gt;
          &lt;springloaded.version&gt;1.2.0.RELEASE&lt;/springloaded.version&gt;
  
          &lt;spring-security.version&gt;4.0.0.RC1&lt;/spring-security.version&gt;
  
      &lt;/properties&gt;
  
      &lt;dependencies&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;log4j&lt;/groupId&gt;
              &lt;artifactId&gt;log4j&lt;/artifactId&gt;
              &lt;version&gt;${log4j.version}&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework&lt;/groupId&gt;
              &lt;artifactId&gt;spring-context&lt;/artifactId&gt;
              &lt;version&gt;${org.springframework-version}&lt;/version&gt;
              &lt;exclusions&gt;
                  &lt;exclusion&gt;
                      &lt;groupId&gt;commons-logging&lt;/groupId&gt;
                      &lt;artifactId&gt;commons-logging&lt;/artifactId&gt;
                  &lt;/exclusion&gt;
              &lt;/exclusions&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework&lt;/groupId&gt;
              &lt;artifactId&gt;spring-websocket&lt;/artifactId&gt;
              &lt;version&gt;${org.springframework-version}&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework&lt;/groupId&gt;
              &lt;artifactId&gt;spring-messaging&lt;/artifactId&gt;
              &lt;version&gt;${org.springframework-version}&lt;/version&gt;
          &lt;/dependency&gt;
  
  
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.session&lt;/groupId&gt;
              &lt;artifactId&gt;spring-session&lt;/artifactId&gt;
              &lt;version&gt;1.0.1.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.session&lt;/groupId&gt;
              &lt;artifactId&gt;spring-session-data-redis&lt;/artifactId&gt;
              &lt;version&gt;1.0.1.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework&lt;/groupId&gt;
              &lt;artifactId&gt;spring-web&lt;/artifactId&gt;
              &lt;version&gt;4.1.6.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.data&lt;/groupId&gt;
              &lt;artifactId&gt;spring-data-redis&lt;/artifactId&gt;
              &lt;version&gt;1.3.0.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;redis.clients&lt;/groupId&gt;
              &lt;artifactId&gt;jedis&lt;/artifactId&gt;
              &lt;version&gt;2.4.2&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;redis.embedded&lt;/groupId&gt;
              &lt;artifactId&gt;embedded-redis&lt;/artifactId&gt;
              &lt;version&gt;0.5&lt;/version&gt;
          &lt;/dependency&gt;
  
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework&lt;/groupId&gt;
              &lt;artifactId&gt;spring-webmvc&lt;/artifactId&gt;
              &lt;version&gt;${org.springframework-version}&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework&lt;/groupId&gt;
              &lt;artifactId&gt;spring-beans&lt;/artifactId&gt;
              &lt;version&gt;4.1.7.RELEASE&lt;/version&gt;
          &lt;/dependency&gt;
  
  
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.data&lt;/groupId&gt;
              &lt;artifactId&gt;spring-data-rest-webmvc&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
          &lt;!-- PERSISTANCE --&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-data-jpa&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.postgresql&lt;/groupId&gt;
              &lt;artifactId&gt;postgresql&lt;/artifactId&gt;
              &lt;version&gt;9.3-1101-jdbc41&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.hibernate&lt;/groupId&gt;
              &lt;artifactId&gt;hibernate-validator&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
          &lt;!-- SECURITY --&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-core&lt;/artifactId&gt;
              &lt;version&gt;${spring-security.version}&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-messaging&lt;/artifactId&gt;
              &lt;version&gt;${spring-security.version}&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-config&lt;/artifactId&gt;
              &lt;version&gt;${spring-security.version}&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-web&lt;/artifactId&gt;
              &lt;version&gt;${spring-security.version}&lt;/version&gt;
              &lt;exclusions&gt;
                  &lt;exclusion&gt;
                      &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                      &lt;artifactId&gt;spring-jdbc&lt;/artifactId&gt;
                  &lt;/exclusion&gt;
              &lt;/exclusions&gt;
          &lt;/dependency&gt;
  
  
          &lt;dependency&gt;
              &lt;groupId&gt;io.jsonwebtoken&lt;/groupId&gt;
              &lt;artifactId&gt;jjwt&lt;/artifactId&gt;
              &lt;version&gt;0.3&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;net.sf.ehcache&lt;/groupId&gt;
              &lt;artifactId&gt;ehcache-core&lt;/artifactId&gt;
              &lt;version&gt;2.6.11&lt;/version&gt;
          &lt;/dependency&gt;
  
  
          &lt;!--ASPECT--&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-aop&lt;/artifactId&gt;
          &lt;/dependency&gt;
  
  
          &lt;!--CONVERTERS--&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;commons-beanutils&lt;/groupId&gt;
              &lt;artifactId&gt;commons-beanutils&lt;/artifactId&gt;
              &lt;version&gt;1.9.0&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;!-- JODA Time --&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;joda-time&lt;/groupId&gt;
              &lt;artifactId&gt;joda-time&lt;/artifactId&gt;
              &lt;version&gt;2.3&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;!-- LOMBOK --&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.projectlombok&lt;/groupId&gt;
              &lt;artifactId&gt;lombok&lt;/artifactId&gt;
              &lt;version&gt;1.14.8&lt;/version&gt;
          &lt;/dependency&gt;
  
  
          &lt;!-- JSON Support --&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;com.fasterxml.jackson.module&lt;/groupId&gt;
              &lt;artifactId&gt;jackson-module-jsonSchema&lt;/artifactId&gt;
              &lt;version&gt;2.3.0&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;com.fasterxml.jackson.core&lt;/groupId&gt;
              &lt;artifactId&gt;jackson-annotations&lt;/artifactId&gt;
              &lt;version&gt;2.3.3&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;com.jayway.jsonpath&lt;/groupId&gt;
              &lt;artifactId&gt;json-path&lt;/artifactId&gt;
              &lt;version&gt;0.8.1&lt;/version&gt;
              &lt;scope&gt;test&lt;/scope&gt;
          &lt;/dependency&gt;
  
  
          &lt;!-- TESTING --&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.hamcrest&lt;/groupId&gt;
              &lt;artifactId&gt;hamcrest-all&lt;/artifactId&gt;
              &lt;version&gt;1.3&lt;/version&gt;
              &lt;scope&gt;test&lt;/scope&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;junit&lt;/groupId&gt;
              &lt;artifactId&gt;junit&lt;/artifactId&gt;
              &lt;version&gt;${junit.version}&lt;/version&gt;
              &lt;scope&gt;test&lt;/scope&gt;
              &lt;exclusions&gt;
                  &lt;exclusion&gt;
                      &lt;artifactId&gt;hamcrest-core&lt;/artifactId&gt;
                      &lt;groupId&gt;org.hamcrest&lt;/groupId&gt;
                  &lt;/exclusion&gt;
              &lt;/exclusions&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.mockito&lt;/groupId&gt;
              &lt;artifactId&gt;mockito-core&lt;/artifactId&gt;
              &lt;version&gt;1.9.5&lt;/version&gt;
              &lt;scope&gt;test&lt;/scope&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-test&lt;/artifactId&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
              &lt;artifactId&gt;spring-security-test&lt;/artifactId&gt;
              &lt;version&gt;4.0.0.M1&lt;/version&gt;
          &lt;/dependency&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;com.jayway.restassured&lt;/groupId&gt;
              &lt;artifactId&gt;rest-assured&lt;/artifactId&gt;
              &lt;version&gt;2.4.1&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;!--JSON Doc--&gt;
          &lt;dependency&gt;
              &lt;groupId&gt;com.mangofactory&lt;/groupId&gt;
              &lt;artifactId&gt;swagger-springmvc&lt;/artifactId&gt;
              &lt;version&gt;0.8.2&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.jsondoc&lt;/groupId&gt;
              &lt;artifactId&gt;spring-boot-starter-jsondoc&lt;/artifactId&gt;
              &lt;version&gt;1.1.0&lt;/version&gt;
          &lt;/dependency&gt;
  
          &lt;dependency&gt;
              &lt;groupId&gt;org.jsondoc&lt;/groupId&gt;
              &lt;artifactId&gt;jsondoc-ui-webjar&lt;/artifactId&gt;
              &lt;version&gt;1.1.0&lt;/version&gt;
          &lt;/dependency&gt;
  
  
      &lt;/dependencies&gt;
  
      &lt;build&gt;
          &lt;plugins&gt;
              &lt;plugin&gt;
                  &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
                  &lt;artifactId&gt;spring-boot-maven-plugin&lt;/artifactId&gt;
                  &lt;dependencies&gt;
                      &lt;dependency&gt;
                          &lt;groupId&gt;org.springframework&lt;/groupId&gt;
                          &lt;artifactId&gt;springloaded&lt;/artifactId&gt;
                          &lt;version&gt;${springloaded.version}&lt;/version&gt;
                      &lt;/dependency&gt;
                  &lt;/dependencies&gt;
              &lt;/plugin&gt;
  
              &lt;plugin&gt;
                  &lt;artifactId&gt;maven-assembly-plugin&lt;/artifactId&gt;
                  &lt;version&gt;2.4&lt;/version&gt;
                  &lt;configuration&gt;
                      &lt;descriptor&gt;src/assembly/dep.xml&lt;/descriptor&gt;
                  &lt;/configuration&gt;
              &lt;/plugin&gt;
          &lt;/plugins&gt;
      &lt;/build&gt;
  
      &lt;repositories&gt;
          &lt;repository&gt;
              &lt;id&gt;spring-releases&lt;/id&gt;
              &lt;url&gt;https://repo.spring.io/libs-release&lt;/url&gt;
          &lt;/repository&gt;        
  
          &lt;repository&gt;
              &lt;id&gt;clojars.org&lt;/id&gt;
              &lt;url&gt;http://clojars.org/repo&lt;/url&gt;
          &lt;/repository&gt;
          &lt;repository&gt;
              &lt;id&gt;closure&lt;/id&gt;
              &lt;url&gt;http://clojars.org/repo&lt;/url&gt;
          &lt;/repository&gt;
          &lt;repository&gt;
              &lt;id&gt;spring-milestones&lt;/id&gt;
              &lt;url&gt;http://repo.spring.io/milestone&lt;/url&gt;
              &lt;snapshots&gt;&lt;enabled&gt;false&lt;/enabled&gt;&lt;/snapshots&gt;
              &lt;releases&gt;&lt;enabled&gt;true&lt;/enabled&gt;&lt;/releases&gt;
          &lt;/repository&gt;
          &lt;repository&gt;
              &lt;id&gt;java-net&lt;/id&gt;
              &lt;url&gt;https://maven.java.net/content/repositories/releases&lt;/url&gt;
          &lt;/repository&gt;
  
      &lt;/repositories&gt;
  
      &lt;pluginRepositories&gt;
          &lt;pluginRepository&gt;
              &lt;id&gt;spring-releases&lt;/id&gt;
              &lt;url&gt;https://repo.spring.io/libs-release&lt;/url&gt;
          &lt;/pluginRepository&gt;
      &lt;/pluginRepositories&gt;
  
  &lt;/project&gt;
  </code></pre>
  
  <p>thanks in advance for your help</p>
  
  <p><strong>Update</strong></p>
  
  <p>I had the below LoginController as part of my project Controller classes. The /authenticate Controller is related to the POST method of the X-Auth authentication mechanism used by Spring Security. I found out that once this controlled has been removed from the project - the HTTP 405 Not Allowed error disappeared.
  I have to admit that I have no clue as for the reason. I just used trial&amp;error to try and find the issue with the 405 error.
  Appreciate if someone could help me understand what might be the problem. tnx</p>
  
  <pre><code>package com.iotiki.controller;
  
  
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.security.access.annotation.Secured;
  import org.springframework.web.bind.annotation.RequestBody;
  import org.springframework.web.bind.annotation.RequestMapping;
  import org.springframework.web.bind.annotation.RequestMethod;
  import org.springframework.web.bind.annotation.RestController;
  
  import javax.validation.Valid;
  
  
  @RestController
  public class LoginController {
  
      @Autowired
      private LoginBusinessLogic loginBusinessLogic;
  
      @RequestMapping(value=ApiController.AUTHENTICATE_URL/*"/authenticate"*/,method= RequestMethod.POST)
      public String login(@Valid @RequestBody LoginDTO loginDTO) throws UnAuthorizedException {
          return "this method should not be called, since Spring Security should take over";
  
      }
  
  
      @RequestMapping(method=RequestMethod.GET)
      public LoginDTO getLoginDTO(){
          return new LoginDTO();
      }
  }
  </code></pre>