Spring graceful shutdown - REQUEST METHOD POST NOT SUPPORTED

Question

I'm trying to use the Spring endpoints to gracefully shut down my application but I'm getting an error:

2016-08-09 13:46:54.606  WARN 13315 --- [nio-8090-exec-6] .w.s.m.s.DefaultHandlerExceptionResolver : Handler execution resulted in exception: Request method 'POST' not supported

I'm using this guide and I've set my application.properties to have endpoints.shutdown.enabled=true and also endpoints.shutdown.sensitive=false . I've also included compile("org.springframework.boot:spring-boot-starter-actuator") in my build.gradle.

When I send the CURL request: curl -X POST https://localhost:8090/shutdown -k
I get the following response from the server:

{"timestamp":1470747537792,"status":405,"error":"Method Not Allowed","exception":"org.springframework.web.HttpRequestMethodNotSupportedException","message":"Request method 'POST' not supported","path":"/shutdown"}

Am I doing anything incorrectly? Is there anything that I may be missing? I have CSRF enabled throughout the app so it's not an option to disable that for my application.

Answer 1

You need to send a CSRF token either as a header or a parameter or something. Your example:

curl -X POST https://localhost:8090/shutdown -k

does not include a CSRF token so of course Spring will reject it. That is indeed the whole point of the CSRF filter. You will need to decide whether it is appropriate to exclude the /shutdown uri from that filter or whether you want to require a token/nonce to be present.

Answer 2

As david suggested, CSRF is required because it's globally required for all POST requests by Spring. So The only way I could think of bypassing it is by disabling the CSRF for the /shutdown endpoint.

In my SecurityConfig I set:

http.csrf().ignoringAntMatchers("/shutdown");

This would disable the csrf protection only for the /shutdown url whilst keeping it active for the rest of the application.

Note: This facility was added in Spring 4.

Answer 3

我正在使用 Springboot-1.5.3-RELEASE，使用 http 方法POST （不是 GET）。它有效。

Answer 4

If you use spring-boot-starter-actuator:

I had the same issue and added following text into the application.properties file in the src/main/resources folder.

management.endpoint.shutdown.enabled=true
management.endpoints.web.exposure.include=health,info,shutdown

Rebuild the application, run it and send the request ( for example: localhost:8080/actuator/shutdown )