private Set<String> httpMethodsFromOptions(String[] options) {
        Set<String> methods = new HashSet<String>();

        if (options != null) {
            for (String option : options) {
                // to be backwards compatible with 1.3, we can ONLY check for known args
                // ideally we would just validate HTTP methods, but someone could already be using this for webdav
                if (!option.equalsIgnoreCase(PERMISSIVE)) {
                    methods.add(option.toUpperCase(Locale.ENGLISH));
                }
            }
        }
        return methods;
    }
The Basic authentication filter can be configured with a list of HTTP methods to which it should apply. This
method ensures that authentication is <em>only</em> required for those HTTP methods specified. For example,
if you had the configuration:
<pre>
   [urls]
   /basic/** = authcBasic[POST,PUT,DELETE]
</pre>
then a GET request would not required authentication but a POST would.

@param request     The current HTTP servlet request.
@param response    The current HTTP servlet response.
@param mappedValue The array of configured HTTP methods as strings. This is empty if no methods are configured.
web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java