web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java
public void setAllowedHttpMethods(Collection<String> allowedHttpMethods) {
		if (allowedHttpMethods == null) {
			throw new IllegalArgumentException("allowedHttpMethods cannot be null");
		}
		if (allowedHttpMethods == ALLOW_ANY_HTTP_METHOD) {
			this.allowedHttpMethods = ALLOW_ANY_HTTP_METHOD;
		} else {
			this.allowedHttpMethods = new HashSet<>(allowedHttpMethods);
		}
	}
public void setAllowedHttpMethods(Collection<String> allowedHttpMethods) {
		if (allowedHttpMethods == null) {
			throw new IllegalArgumentException("allowedHttpMethods cannot be null");
		}
		if (allowedHttpMethods == ALLOW_ANY_HTTP_METHOD) {
			this.allowedHttpMethods = ALLOW_ANY_HTTP_METHOD;
		} else {
			this.allowedHttpMethods = new HashSet<>(allowedHttpMethods);
		}
	}
public void setAllowedHttpMethods ( Collection < String > allowedHttpMethods ) { if ( allowedHttpMethods == null ) { throw new IllegalArgumentException ( "allowedHttpMethods cannot be null" ) ; } if ( allowedHttpMethods == ALLOW_ANY_HTTP_METHOD ) { this . allowedHttpMethods = ALLOW_ANY_HTTP_METHOD ; } else { this . allowedHttpMethods = new HashSet <> ( allowedHttpMethods ) ; } }
<p>
Determines which HTTP methods should be allowed. The default is to allow "DELETE", "GET", "HEAD", "OPTIONS",
"PATCH", "POST", and "PUT".
</p>

@param allowedHttpMethods the case-sensitive collection of HTTP methods that are allowed.
@see #setUnsafeAllowAnyHttpMethod(boolean)
@since 5.1
<p > Determines which HTTP methods should be allowed . The default is to allow DELETE GET HEAD OPTIONS PATCH POST and PUT . < / p >