[FIXED JENKINS-16918] Use HTTP 405 when POST is required.

changelog.html

@@ -60,6 +60,9 @@ Upcoming changes</a>
   <li class=bug>
     Form validation methods weren't getting triggered when one of its dependency controls change.
     (<a href="https://issues.jenkins-ci.org/browse/JENKINS-19124">issue 19124</a>)
+  <li class=bug>
+    When POST is required for some HTTP operation but GET was used, the response should have status code 405.
+    (<a href="https://issues.jenkins-ci.org/browse/JENKINS-16918">issue 16918</a>)
 </ul>
 </div><!--=TRUNK-END=-->
 

core/src/main/java/hudson/model/BuildAuthorizationToken.java

@@ -31,6 +31,7 @@ import org.kohsuke.stapler.StaplerRequest;
 import org.kohsuke.stapler.StaplerResponse;
 
 import java.io.IOException;
+import javax.servlet.http.HttpServletResponse;
 import jenkins.security.ApiTokenProperty;
 import org.acegisecurity.AccessDeniedException;
 import org.kohsuke.stapler.HttpResponses;
@@ -84,6 +85,8 @@ public final class BuildAuthorizationToken {
             return;
         }
 
+        rsp.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
+        rsp.addHeader("Allow", "POST");
         throw HttpResponses.forwardToView(project, "requirePOST.jelly");
     }
 

test/src/test/java/jenkins/model/JenkinsTest.java

@@ -290,7 +290,7 @@ public class JenkinsTest extends HudsonTestCase {
         jenkins.setCrumbIssuer(null);
         WebClient wc = createWebClient();
         wc.login("alice");
-        wc.assertFails("eval", HttpURLConnection.HTTP_INTERNAL_ERROR);
+        wc.assertFails("eval", HttpURLConnection.HTTP_BAD_METHOD);
         assertEquals("3", eval(wc));
         wc.login("bob");
         try {