diff --git a/itest/web/src/main/webapp/WEB-INF/security.tld b/itest/web/src/main/webapp/WEB-INF/security.tld
index ade20b534c..77dfe18287 100644
--- a/itest/web/src/main/webapp/WEB-INF/security.tld
+++ b/itest/web/src/main/webapp/WEB-INF/security.tld
@@ -32,7 +32,7 @@
         <attribute>
             <name>url</name>
             <required>false</required>
-            <rtexprvalue>false</rtexprvalue>
+            <rtexprvalue>true</rtexprvalue>
             <description>
                 A URL within the application. If the user has access to this URL (as determined by
                 the AccessDecisionManager), the tag body will be evaluated. If not, it will
diff --git a/taglibs/src/main/resources/META-INF/security.tld b/taglibs/src/main/resources/META-INF/security.tld
index ade20b534c..77dfe18287 100644
--- a/taglibs/src/main/resources/META-INF/security.tld
+++ b/taglibs/src/main/resources/META-INF/security.tld
@@ -32,7 +32,7 @@
         <attribute>
             <name>url</name>
             <required>false</required>
-            <rtexprvalue>false</rtexprvalue>
+            <rtexprvalue>true</rtexprvalue>
             <description>
                 A URL within the application. If the user has access to this URL (as determined by
                 the AccessDecisionManager), the tag body will be evaluated. If not, it will