spring security tags

//要使用security tags,必须在maven中加入tags的依赖
<dependency>
	<groupId>org.springframework.security</groupId>
	<artifactId>spring-security-taglibs</artifactId>
	<version>4.0.4.RELEASE</version>
</dependency>

 

spring security 4.x版本取消了ifAllGranted的语法:

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" %>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <base href="<%=basePath%>">
    
    <title>My JSP 'index.jsp' starting page</title>
    
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
	<meta http-equiv="pragma" content="no-cache">
	<meta http-equiv="cache-control" content="no-cache">
	<meta http-equiv="expires" content="0">    
	<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
	<meta http-equiv="description" content="This is my page">
	<!--
	<link rel="stylesheet" type="text/css" href="styles.css">
	-->
  </head>
  
  <body>
  
	Dear <strong>${user}</strong>, Welcome to Home Page.
	<a href="<c:url value="/logout" />">Logout</a>
  
	<form action="">
		
		<sec:authentication property="name"/>
		<br />
		<sec:authentication property="principal.username"/>
		<br />
		<!-- 需要注意的是因为access属性是使用表达式的,所以我们必须确保ApplicationContext中存在一个WebSecurityExpressionHandler,
			最简单的办法就是直接使用NameSpace,通过设置http元素的use-expressions="true"让NameSpace自动为我们创建一个WebSecurityExpressionHandler。 -->
  		<sec:authorize access="hasRole('ROLE_ADMIN')">
  			<a href="security/index.jsp">admin page</a>
  		</sec:authorize>
		<sec:authorize access="hasRole('ROLE_ADMIN') and hasRole('ROLE_USER')">
			<p>Must have ROLE_ADMIN and ROLE_USER</p>
		</sec:authorize>
		<sec:authorize access="hasAnyRole('ROLE_ADMIN','ROLE_USER')">
			<p>Must have ROLE_ADMIN or ROLE_USER</p>
		</sec:authorize>
		<sec:authorize access="!hasAnyRole('ROLE_ADMIN','ROLE_USER')">
			<p>Must not have ROLE_ADMIN or ROLE_USER</p>
		</sec:authorize>

		<sec:authorize url="/security/index.jsp">
			<a href="security/index.jsp">admin page</a>
		</sec:authorize>
  	</form>
	    
  </body>
</html>

 

 

你可能感兴趣的:(spring security tags)