Kleber Mota
Kleber Mota

Reputation: 9055

thymeleaf security tags not being displayed, either with authenticated or anonymous access

In my current spring project, I have a view with this code:

      <ul class="nav navbar-nav navbar-right" sec:authorize="isAnonymous()">
        <li><a th:href="@{/signin}" th:utext="#{signin}"></a></li>
        <li><a th:href="@{/signup}" th:utext="#{signup}"></a></li>
     </ul>
     <ul class="nav navbar-nav navbar-right" sec:authorize="isAuthenticated()">
        <li><a th:href="@{/cart}"><span class="glyphicon glyphicon-shopping-cart" aria-hidden="true"></span></a></li>
        <li sec:authorize="hasPermission(#user, 'admin')"><a th:href="@{/admin}"><span class="glyphicon glyphicon-cog" aria-hidden="true"></span></a></li>
        <li class="dropdown">
            <a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false"><span sec:authentication="name">Teste</span> <span class="caret"></span></a>
            <ul class="dropdown-menu">
                <li><a href="#"><span class="glyphicon glyphicon-user" aria-hidden="true"></span><span th:utext="#{myaccount}"></span></a></li>
                <li><a href="#"><span class="glyphicon glyphicon-heart" aria-hidden="true"></span><span th:utext="#{mywishlist}"></span></a></li>
                <li><a href="#"><span class="glyphicon glyphicon-briefcase" aria-hidden="true"></span><span th:utext="#{myorders}"></span></a></li>
            </ul>
        </li>
        <li><a th:href="@{/logout}"><span class="glyphicon glyphicon-off" aria-hidden="true"></span></a></li>
      </ul>

When I open the page in the browser, nothing is displayed, neither the tags marked with sec:authorize="isAnonymous()" or the ones marked with sec:authorize="isAuthenticated()".

My configuration is this:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns:p="http://www.springframework.org/schema/p"
        xmlns:context="http://www.springframework.org/schema/context"
        xmlns:security="http://www.springframework.org/schema/security"
        xmlns:mvc="http://www.springframework.org/schema/mvc"
        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">  
    <security:http pattern="/" security="none"></security:http>

    <security:http pattern="/css/**" security="none"></security:http>

    <security:http pattern="/img/**" security="none"></security:http>

    <security:http pattern="/js/**" security="none"></security:http>

    <security:http use-expressions="true">
        <security:form-login login-page="/signin"
            login-processing-url="/login" username-parameter="login"
            password-parameter="senha" />
        <security:logout logout-url="/logout"
            delete-cookies='JSESSIONID' logout-success-url="/" />
        <security:remember-me key="remember-me"
            remember-me-parameter="remember-me" remember-me-cookie="remember-me" /><security:csrf
            disabled="true" />
    </security:http>

    <security:authentication-manager>
        <security:authentication-provider user-service-ref="userDetailsService">
            <security:password-encoder ref="passwordEncoder"></security:password-encoder>
        </security:authentication-provider>
    </security:authentication-manager>

    <bean id="userDetailsService" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
        <property name="dataSource" ref="dataSource"></property>
        <property name="usersByUsernameQuery" value="select login, senha, enabled from usuario where login = ?"></property>
        <property name="authoritiesByUsernameQuery" value="SELECT t1.username, t2.authority FROM (SELECT u.login as username, c.nome as credencial FROM usuario u, usuario_credencial uc, credencial c WHERE u.id = uc.usuario_id and c.id = uc.credenciais_id) as t1 INNER JOIN (SELECT c.nome as credencial, a.nome as authority FROM credencial c, credencial_autorizacao ca, autorizacao a WHERE c.id = ca.credencial_id and a.id = ca.autorizacoes_id) as t2 ON t1.credencial = t2.credencial WHERE t1.username = ?;"></property>
    </bean>

    <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder">
        <constructor-arg name="strength" value="4"></constructor-arg></bean>
    <bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
        <property name="permissionEvaluator" ref="permissionEvaluator"></property></bean>
    <bean id="permissionEvaluator" class="org.kleber.MyPermissionEvaluator"></bean>
</beans>

Can someone give a hint of what's the problem here?

ps.: this is my pom.xml regards the thymeleaf dependencies:

<dependency>
    <groupId>org.thymeleaf</groupId>
    <artifactId>thymeleaf</artifactId>
    <version>2.1.5.RELEASE</version>
</dependency>
<dependency>
    <groupId>org.thymeleaf</groupId>
    <artifactId>thymeleaf-spring4</artifactId>
    <version>2.1.5.RELEASE</version>
</dependency>
<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity4</artifactId>
    <version>2.1.3.RELEASE</version>
</dependency>

Upvotes: 0

Views: 505

Answers (1)

Kleber Mota
Kleber Mota

Reputation: 9055

I finally solve this on my own. The problem here was with this line I had on my XML configuration file:

<security:http pattern="/" security="none"></security:http>

After I remove it, both conditions start to work fine. Seems like with this line, the security context completely stop work on this web page.

Upvotes: 1

Related Questions