Restricting access by HTTP method may lead to a problem, see more in https://blog.gypsyengineer.com/en/security/tips-configuring-security-rest-api-spring.html

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // ...
        http.authorizeRequests()
                .antMatchers(HttpMethod.GET).access("#oauth2.hasScope('get')")
                .antMatchers(HttpMethod.POST).access(""#oauth2.hasScope('post')"")
                .antMatchers(HttpMethod.PUT).access(""#oauth2.hasScope('put')"")
                .antMatchers(HttpMethod.DELETE).access(""#oauth2.hasScope('delete')"")
                .antMatchers(HttpMethod.PATCH).access(""#oauth2.hasScope('patch')"")
                .antMatchers(HttpMethod.OPTIONS).access(""#oauth2.hasScope('options')"")
                .antMatchers(HttpMethod.TRACE).access(""#oauth2.hasScope('trace')"");
        // did we forget anything?
        // ...
    }
}