Spring Security JSP Tag Library
Spring Security provides its own tags for jsp pages. These tags are used to access security information and apply security constraints in JSPs.
The following tags are used to secure view layer of the application.
This tag is used for authorization purpose. This tag evaluates and check whether the request is authorized or not.
It uses two attributes access and URL to check request authorization. We can pass user's role to evaluate this tag.
The content written inside this tag will display only if the attribute is satisfy. For example.
This tag is used to access the authentication stored into the security context. It can be used to get current user details if the Authentication is an instance of UserDetails object. For example.
This tag is used with Spring Security's ACL module. It checks list of required permissions for the specified domains. It executes only if current user has all the permissions. For example.
This tag is used to create CSRF tokens for the HTML form. To use it make sure CSRF protection is enabled. We should place this tag inside the <form></form> tag to create CSRF token. For example.
This tag should place inside the HTML <head> tag.
Spring Security Taglib JAR
To implement any of these tags, we must have spring security taglib jar in our application. It can also be added using following maven dependecy.
Spring Security Taglib Declaration
In JSP page, we can use taglib by using the following declaration.
Now, lets see an example to implement these tags in spring security maven project.
We are using STS (Spring Tool Suite) to create the project. See the example.
Click on finish button and it will create a maven project that looks like this:
Spring Security Configuration
To configure Spring Security in the Spring MVC application, put the following four files inside the com.javatpoint folder.
The AppConfig is used to set view location suffix of the view files.
This class is used to initialize servlet dispatcher.
Create one more class that is used to create user and apply authentication and authorization on the user accessibility.
Now, create a controller to handle request and respond back.
Create view (jsp) files to show the output to the user. We have created three JSP files, see the below.
In the admin page, we have used authorize tag to that evaluates only when the given role is satisfied.
Our project contains the following dependencies that are required to build application.
After adding all these files, our project looks like this:
Run the Application
Right click on the project and select run on server. It shows the following output to the browser.
Click on the User and Login by providing credentials that are set in AppSecurityConfig file.
After successful login, it shows the admin page that looks like below. Here, notice that the content written inside the authorize tag is not displayed because logged in user has role USER.
Logout and now login as an admin by providing admin credentials.
After logged in as admin, see this time the authorize tag evaluates and it shows the following output.
Download the example