Spring Security JSP Tag Library Spring Security provides its own tags for jsp pages. These tags are used to access security information and apply security constraints in JSPs. The following tags are used to secure view layer of the application.
- Authorize Tag
- Authentication Tag
- Accesscontrollist Tag
- Csrfinput Tag
- CsrfMetaTags Tag
Authorize Tag This tag is used for authorization purpose. This tag evaluates and check whether the request is authorized or not. It uses two attributes access and URL to check request authorization. We can pass user's role to evaluate this tag. The content written inside this tag will display only if the attribute is satisfy. For example.
Authentication Tag This tag is used to access the authentication stored into the security context. It can be used to get current user details if the Authentication is an instance of UserDetails object. For example.
Accesscontrollist Tag This tag is used with Spring Security's ACL module. It checks list of required permissions for the specified domains. It executes only if current user has all the permissions. For example.
CsrfInput Tag This tag is used to create CSRF tokens for the HTML form. To use it make sure CSRF protection is enabled. We should place this tag inside the tag to create CSRF token. For example.
CsrfMetaTags Tag It inserts meta tag that contains CSRF token, form field, header name and CSRF token value. These values are useful to set CSRF token within JavaScript in the application. This tag should place inside the HTML tag. Spring Security Taglib JAR To implement any of these tags, we must have spring security taglib jar in our application. It can also be added using following maven dependecy.
Spring Security Taglib Declaration In JSP page, we can use taglib by using the following declaration.
Now, lets see an example to implement these tags in spring security maven project. We are using STS (Spring Tool Suite) to create the project. See the example. Create Project Click on finish button and it will create a maven project that looks like this: Spring Security Configuration To configure Spring Security in the Spring MVC application, put the following four files inside the com.w3cschoool folder. AppConfig.java
The AppConfig is used to set view location suffix of the view files. // MvcWebApplicationInitializer.java
This class is used to initialize servlet dispatcher. // SecurityWebApplicationInitializer.java
Create one more class that is used to create user and apply authentication and authorization on the user accessibility. // WebSecurityConfig.java
Controller Now, create a controller to handle request and respond back. // HomeController.java
View Create view (jsp) files to show the output to the user. We have created three JSP files, see the below. // index.jsp
// user.jsp
// admin.jsp In the admin page, we have used authorize tag to that evaluates only when the given role is satisfied.
Project Dependencies Our project contains the following dependencies that are required to build application. // pom.xml
After adding all these files, our project looks like this: Run the Application Right click on the project and select run on server. It shows the following output to the browser. Click on the User and Login by providing credentials that are set in AppSecurityConfig file. After successful login, it shows the admin page that looks like below. Here, notice that the content written inside the authorize tag is not displayed because logged in user has role USER. Logout and now login as an admin by providing admin credentials. After logged in as admin, see this time the authorize tag evaluates and it shows the following output. Download the example
|