Spring Security 4 : Request method 'POST' not supported
<p>The issue is that when I click on submit I get</p>

<pre><code>Etat HTTP 405 - Request method 'POST' not supported
</code></pre>

<p>Here is the controller :</p>

<pre><code>@RequestMapping(value = "/admin/login", method = RequestMethod.GET)
public ModelAndView login(
        @RequestParam(value = "error", required = false) String error,
        @RequestParam(value = "logout", required = false) String logout) {
    LOGGER.debug("admin login page");
    ModelAndView model = new ModelAndView();
    if (error != null) {
        model.addObject("error", "Invalid username and password!");
    }

    if (logout != null) {
        model.addObject("msg", "You've been logged out successfully.");
    }

    model.setViewName("/admin/index");
    LOGGER.debug("returning admin login page");

    return model;
}
</code></pre>

<p>And the form :</p>

<pre><code>&lt;form class="m-t" role="form" th:action="@{/admin/login}" method="POST" autocomplete="off"&gt;
    &lt;div th:if="${param.error}" class="alert alert-danger"&gt;Invalid username and password.&lt;/div&gt;
    &lt;div th:if="${param.logout}" class="alert alert-success"&gt;You have been logged out.&lt;/div&gt;
    &lt;div class="form-group"&gt;
        &lt;input type="text" class="form-control" id="username" name="username" placeholder="Username" required="" /&gt;
    &lt;/div&gt;
    &lt;div class="form-group"&gt;
        &lt;input type="password" class="form-control" id="username" name="username" placeholder="Username" required="" /&gt;
    &lt;/div&gt;
    &lt;input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" /&gt;
    &lt;button type="submit" class="btn btn-primary block full-width m-b"&gt;Login&lt;/button&gt;
    &lt;a href="#"&gt;&lt;small&gt;Forgot password?&lt;/small&gt;&lt;/a&gt;
    &lt;p class="text-muted text-center"&gt;
        &lt;small&gt;Do not have an account?&lt;/small&gt;
    &lt;/p&gt;
    &lt;a class="btn btn-sm btn-white btn-block" href="register.html"&gt;Create an account&lt;/a&gt;
&lt;/form&gt;
</code></pre>

<p>It seems like csrf field not working.</p>

<p>I explain, I have normal users website which I refer here by   and admin part which is /admin</p>

<p>The login form is correctly displayed. But I when I click submit I get Etat <code>HTTP 405 - Request method 'POST' not supported</code></p>

<p>Any idea please ?</p>

<p>Here is my security configuration class :</p>

<pre><code>package com.mintad.spring.security;

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;

/**
 * @author Sofiane HAMMAMI
 */
@Configuration
@EnableWebSecurity
@ComponentScan
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    DataSource dataSource;

    @Autowired
    @Qualifier("customUserDetailsService")
    UserDetailsService userDetailsService;

    @Autowired
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/", "/home").permitAll()
            .antMatchers("/admin/**").permitAll()
//          .antMatchers("/admin/**").access("hasRole('ADMIN')")
            .and().formLogin().loginPage("/login")
            .defaultSuccessUrl("/welcome").usernameParameter("username").passwordParameter("password")
            .and().exceptionHandling().accessDeniedPage("/404");
    }
}
</code></pre>