HTTP method PUT not supported in spring boot - ajax

Question

Good morning,
I am developing a Spring boot (latest version) application, secured with Spring security (latest version).
I am trying to make a PUT request from a JSP page to an Spring REST endpoint which should only return a String object, in particular:
JSP code: inside a script i am making the following AJAX request
<!-- change event of batch status script -->
function changeEventStatus(idEvento, statoEvento) {
let data = {"id_evento": idEvento, "stato": statoEvento};
$.ajax({
url: 'http://localhost:8080/entsorgafin/events/api/cambiaStatoEvento',
type: 'PUT',
contentType: 'application/json',
data: JSON.stringify(data)
}).then(function (data) {
console.log("process terminated.");
console.log("data collected:");
console.log(data);
});
}
Controller code: the controller is annotated with #RestController and #CrossOrigin annotations to enable CORS requests and spring automatic management of rest requests
#PutMapping("/cambiaStatoEvento")
public String changeEventStatus(#RequestBody Evento evento)
{
logger.info("API CONTROLLER - changing the status of the event with ID " + evento.getId_evento());
//If the status status is not Risolto, the event will be taken in charge
if(! evento.getStato().equals("Risolto"))
{
logger.info("API CONTROLLER - status of event " + evento.getId_evento() + " changed to In Lavorazione");
eventoService.changeEventStatus(evento.getId_evento(), "In Lavorazione");
} else
{
logger.info("API CONTROLLER - status of event " + evento.getId_evento() + " changed to Risolto");
eventoService.changeEventStatus(evento.getId_evento(), "Risolto");
}
return "SUCCESS";
}
I checked with chrome devtools and the payload is correctly encoded and sent, but Spring boot log this when I make a request:
2021-01-18 17:18:00.822 DEBUG 15564 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet : "FORWARD" dispatch for PUT "/accessDenied", parameters={}
2021-01-18 17:18:00.827 WARN 15564 --- [nio-8080-exec-1] .w.s.m.s.DefaultHandlerExceptionResolver : Resolved [org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'PUT' not supported]
2021-01-18 17:18:00.828 DEBUG 15564 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet : Exiting from "FORWARD" dispatch, status 405
2021-01-18 17:18:00.829 DEBUG 15564 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet : "ERROR" dispatch for PUT "/error", parameters={}
2021-01-18 17:18:00.830 DEBUG 15564 --- [nio-8080-exec-1] s.w.s.m.m.a.RequestMappingHandlerMapping : Mapped to org.springframework.boot.autoconfigure.web.servlet.error.BasicErrorController#error(HttpServletRequest)
2021-01-18 17:18:00.832 DEBUG 15564 --- [nio-8080-exec-1] o.s.w.s.m.m.a.HttpEntityMethodProcessor : Using 'application/json', given [*/*] and supported [application/json, application/*+json, application/json, application/*+json]
2021-01-18 17:18:00.832 DEBUG 15564 --- [nio-8080-exec-1] o.s.w.s.m.m.a.HttpEntityMethodProcessor : Writing [{timestamp=Mon Jan 18 17:18:00 CET 2021, status=405, error=Method Not Allowed, trace=org.springframe (truncated)...]
2021-01-18 17:18:00.833 DEBUG 15564 --- [nio-8080-exec-1] o.s.web.servlet.DispatcherServlet : Exiting from "ERROR" dispatch, status 405
Having said this, I tried GET requests and works just fine as expected, whereas DELETE and POST requests do not work as PUT ones.
Just by reading logs I think is a Spring security problem, but I can't understand what problem I am facing, I read from the Spring documentation that CORS requests are automatically managed and nothing should be done, but it is obviously not working that way.
If someone could help with what I am missing or just point to some place I can find answers as I really do not know what could be wrong here, thanks in advance.
EDIT
Security configuration
package com.entsorgafin.sr002EagleCloud.configuration;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
#SuppressWarnings("SpringJavaAutowiredFieldsWarningInspection")
#Configuration
#EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter
{
//Dependency Injection
#Autowired
private PasswordEncoder passwordEncoder;
#Qualifier("securityUserDetailService")
#Autowired
private UserDetailsService userDetailsService;
/**
* Manages the encoder to save passwords in the DB
* not in plain text
*
* #return PasswordEncoder object
*/
#Bean
public PasswordEncoder passwordEncoder()
{
return new BCryptPasswordEncoder();
}
/**
* Manages the configuration of the Authentication manager with
* user credentials and roles.
* <p>
* The AuthenticationManager processes any authentication request.
*
* #param auth AuthenticationManagerBuilder object
*/
#Autowired
public void configureGlobalSecurity(AuthenticationManagerBuilder auth)
{
auth.authenticationProvider(authenticationProvider());
}
/**
* Manages the configuration for specific http request.
*
* #param http HttpSecurity request
* #throws Exception exception
*/
#Override
protected void configure(HttpSecurity http) throws Exception
{
http.authorizeRequests()
//configure security for pages
.antMatchers("/static/**").permitAll()
.antMatchers(new String[]{"/login", "/accessDenied"}).permitAll()
.antMatchers("/**").access("hasAnyRole('admin', 'operatore', 'ufficio tecnico', 'processista')")
.anyRequest().authenticated()
//creates login form
.and().formLogin().loginPage("/login").loginProcessingUrl("/login")
.defaultSuccessUrl("/home").failureUrl("/accessDenied")
.usernameParameter("id_utente").passwordParameter("password")
//catches exceptions http 403 response
.and().exceptionHandling().accessDeniedPage("/accessDenied");
http.requestCache().disable();
http.logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
}
/**
* Manages the storage of user credentials inside database
*
* #return The authenticationProvider Object
*/
#Bean
public DaoAuthenticationProvider authenticationProvider()
{
DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
authenticationProvider.setUserDetailsService(userDetailsService);
authenticationProvider.setPasswordEncoder(passwordEncoder);
return authenticationProvider;
}
#Bean
public AuthenticationTrustResolver getAuthenticationTrustResolver()
{
return new AuthenticationTrustResolverImpl();
}
}
Regarding csrf I added to the head the JSP meta tag <sec:csrfMetaTags/> which should take care of the csrf protection or at least the documentation says this.
EDIT 2
By changing the Ajax request as follows
<!-- change event of batch status script -->
function changeEventStatus(idEvento, statoEvento) {
let csrfParameter = $("meta[name='_csrf_parameter']").attr("content");
let csrfToken = $("meta[name='_csrf']").attr("content");
let csrfHeader = $("meta[name='_csrf_header']").attr("content");
let data = {};
let headers = {};
data[csrfParameter] = csrfToken;
data["id_evento"] = idEvento;
data["stato"] = statoEvento;
headers[csrfHeader] = csrfToken;
$.ajax({
url: 'http://localhost:8080/entsorgafin/events/api/cambiaStatoEvento',
type: 'PUT',
headers: headers,
contentType: 'application/json',
data: JSON.stringify(data)
}).then(function (data) {
console.log("process terminated.");
console.log("data collected:");
console.log(data);
});
}
the request is performed correctly, now the problem is how to deal with the csrf token, as Spring tries to deserialize and put it into the java object (Evento in this case) and give back
Failed to evaluate Jackson deserialization for type [[simple type, class com.entsorgafin.sr002EagleCloud.model.Evento]]
Could not resolve parameter [0] in public java.lang.String com.entsorgafin.sr002EagleCloud.controller.rest.EventsController_rest.changeEventStatus(com.entsorgafin.sr002EagleCloud.model.Evento): Content type 'application/json;charset=UTF-8' not supported
Completed 415 UNSUPPORTED_MEDIA_TYPE
The payload of the request is:
{_csrf: "88c27418-7d48-4d76-a6ec-d76e7a45a61a", id_evento: 50, stato: "Attivo"}
How can i instruct spring boot not to use the csrf token for deserialization?