how to conditionally show jsp content to logged in users with Spring security

Question

I want to show content to any user that is logged in and to hide if they are not logged in. I'm using jsp's and spring security.

Obviously a home grown solution is easily done. But what's the cleanest standard way of achieving this?

Spring security tags don't seem to have nice way that will allow for the addition of new roles in the future.

Answer 1

Hi there,

Here's how I am doing this:

<%@ page import="org.springframework.security.context.SecurityContextHolder" %>

<c:if test="<%=SecurityContextHolder.getContext().getAuthentication() != null %>">
    <!-- your secure content here -->
</c:if>

Let me know if this works for you too...

-aj

Answer 2

How about:

<%@ taglib uri="http://acegisecurity.org/authz" prefix="authz" %>

<c:set var="authenticated" value="${false}"/>
<authz:authorize ifAllGranted="ROLE_USER">
    <c:set var="authenticated" value="${true}"/>
</authz:authorize>

<c:if test="${authenticated}">
<!-- your secure content here -->
</c:if>

Answer 3

How 'bout this? - Spring 2.5 compliant ;-)

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" %>
<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>

<security:authorize ifAllGranted="ROLE_USER">
   Welcome <%= request.getUserPrincipal().getName() %>
   <a href="<c:url value="/j_spring_security_logout"/>">Logout</a><br/>
</security:authorize>

Answer 4

I've had success with the following:

 <sec:authorize ifAnyGranted="ROLE_ANONYMOUS">
  <td><a href="<c:url value="/login.htm"/>">Login</a></td>
 </sec:authorize>
 <sec:authorize ifNotGranted="ROLE_ANONYMOUS">
  <td><a href="<c:url value="/j_spring_security_logout"/>">Logout</a></td>
 </sec:authorize>

New roles can be added without affecting the logic here.