Spring Security Taglibs control statement

Question

Is there a way to implement control statement with Spring Security taglibs?

Currently we can only check if a user has a role...

<security:authorize access="hasRole('ROLE_ADMIN')">
   // display something
</security:authorize>

How about else?

Answer 1

Value of the access attribute is a SpEL expression, evaluated against WebSecurityExpressionRoot, so you can use all its methods and all SpEL syntax.

Also you can customize creation of the evaluation context by declaring a custom WebSecurityExpressionHandler as a bean (then you can add your own methods and variables).