在此link他们所描述的POST方法是默认的，如果没有的行动相匹配。所以这就是为什么它仍然适用于您的CreateToken（）方法没有HttpPost属性。

In this link they describe the POST method as being the default if none of the actions match. So that's why it still works for your CreateToken() method without an HttpPost attribute .

• 您可以用一个属性指定HTTP方法：AcceptVerbs，HttpDelete，HTTPGET，HttpHead，HttpOptions，HttpPatch，HttpPost或HttpPut


• 否则，如果控制器方法的名称开头获取，邮报，放，删除，头，选项，或补丁，然后按约定行动支持HTTP方法。


• 如果没有上述情况，方法支持POST。

• You can specify the HTTP method with an attribute: AcceptVerbs, HttpDelete, HttpGet, HttpHead, HttpOptions, HttpPatch, HttpPost, or HttpPut.
• Otherwise, if the name of the controller method starts with "Get", "Post", "Put", "Delete", "Head", "Options", or "Patch", then by convention the action supports that HTTP method.
• If none of the above, the method supports POST.