CODEWITHSUNDEEP
spring-mvcgradlespring-securityspring-bootthymeleaf
jschuler
jschuler

Reputation: 55

How to configure thymeleaf-extras-springsecurity4 without xml?

I'm trying to use something like this code snippet in my view, however the content is always shown regardless of the user's role.

<div sec:authorize="hasRole('ROLE_ADMIN')">            
<!-- Some admin content -->
</div>

Upvotes: 2

Views: 1117

Answers (1)

DimaSan
DimaSan

Reputation: 12694

Add to your build.gradle the following dependency:

compile("org.springframework.boot:spring-boot-starter-security")

You must also add Spring Security configuration as in example:

@Configuration
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .inMemoryAuthentication()
                .withUser("admin").password("admin").roles("ADMIN", "USER")
                .and().withUser("user").password("user").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/", "/index/**").permitAll()
                .and().authorizeRequests().antMatchers("/login", "logout").permitAll()
                .and().formLogin().loginPage("/login").defaultSuccessUrl("/").permitAll()
                .and().logout()
                        .deleteCookies("remove")
                        .invalidateHttpSession(true)
                        .logoutUrl("/logout")
                        .logoutSuccessUrl("/logout-success")
                        .logoutRequestMatcher(new AntPathRequestMatcher("/logout"));
    }
}

Read more at Securing a Web Application.

Upvotes: 1

Related Questions