protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        HttpServletRequest httpRequest = WebUtils.toHttp(request);
        String httpMethod = httpRequest.getMethod();

        // Check whether the current request's method requires authentication.
        // If no methods have been configured, then all of them require auth,
        // otherwise only the declared ones need authentication.

        Set<String> methods = httpMethodsFromOptions((String[]) mappedValue);
        boolean authcRequired = methods.size() == 0;
        for (String m : methods) {
            // list of methods is in upper case
            if (httpMethod.toUpperCase(Locale.ENGLISH).equals(m)) {
                authcRequired = true;
                break;
            }
        }

        if (authcRequired) {
            return super.isAccessAllowed(request, response, mappedValue);
        } else {
            return true;
        }
    }
The Basic authentication filter can be configured with a list of HTTP methods to which it should apply. This
method ensures that authentication is <em>only</em> required for those HTTP methods specified. For example,
if you had the configuration:
<pre>
   [urls]
   /basic/** = authcBasic[POST,PUT,DELETE]
</pre>
then a GET request would not required authentication but a POST would.

@param request     The current HTTP servlet request.
@param response    The current HTTP servlet response.
@param mappedValue The array of configured HTTP methods as strings. This is empty if no methods are configured.
web/src/main/java/org/apache/shiro/web/filter/authc/HttpAuthenticationFilter.java