1.0
1.2
security
http://www.springframework.org/security/tags
Spring Security Authorization Tag Library
authorize
org.springframework.security.taglibs.authz.AuthorizeTag
A tag which outputs the body of the tag if the configured access expression evaluates to true for the currently authenticated principal.
access
false
false
A Spring-EL expression which is supported by the WebSecurityExpressionHandler in the application context. The latter will be used to evaluate the expression.
url
false
true
A URL within the application. If the user has access to this URL (as determined by the AccessDecisionManager), the tag body will be evaluated. If not, it will be skipped.
method
false
false
Can optionally be used to narrow down the HTTP method (typically GET or POST) to which the URL applies to. Only has any meaning when used in combination with the "url" attribute.
var
false
false
A page scoped variable into which the boolean result of the tag evaluation will be written, allowing the same condition to be reused subsequently in the page without re-evaluation.
ifNotGranted
false
true
A comma separated list of roles which the user must not have for the body to be output. Deprecated in favour of the access expression.
ifAllGranted
false
true
A comma separated list of roles which the user must all possess for the body to be output. Deprecated in favour of the access expression.
ifAnyGranted
false
true
A comma separated list of roles, one of which the user must possess for the body to be output. Deprecated in favour of the access expression.
authentication
org.springframework.security.taglibs.authz.AuthenticationTag
Allows access to the current Authentication object.
property
true
true
Property of the Authentication object which should be output. Supports nested properties. For example if the principal object is an instance of UserDetails, the property "principal.username" will return the username. Alternatively, using "name" will call getName method on the Authentication object directly.
var
false
false
Name of the exported scoped variable which will contain the evaluated property of the Authentication object.
Set HTML escaping for this tag, as a boolean value.
htmlEscape
false
true
scope
false
false
Scope for var.
accesscontrollist
org.springframework.security.taglibs.authz.AccessControlListTag
Allows inclusion of a tag body if the current Authentication has one of the specified permissions to the presented domain object instance.
hasPermission
true
true
A comma separated list of permissions, which will be converted to Permission instances by the configured PermissionFactory.
domainObject
true
true
The actual domain object instance for which permissions are being evaluated.
var
false
false
A page scoped variable into which the boolean result of the tag evaluation will be written, allowing the same condition to be reused subsequently in the page without re-evaluation.