如何使用弹簧安全显示隐藏元素

Question

我有一个按钮，我想在登录页面中显示。

所以当用户登录时我想隐藏这个按钮。我觉得

<sec:authorize access="isAuthenticated()">

对此很有用，所以我在我的jsp中包含了类似以下的内容

<sec:authorize access="not isAuthenticated()">
            <div class="pull-right">

但在登录页面以及登录后不可见。

可能是什么问题。

<http pattern="/foobar/static-wro4j/**" security="none"/>
<http pattern="/foobar/static/**" security="none"/>
<http pattern="/foobar/login*" security="none"/>
<http pattern="/foobar/syndic/**" security="none"/>
<http pattern="/foobar/register/**" security="none"/>
<http pattern="/foobar/lostpassword/**" security="none"/>

<http auto-config="true" use-expressions="true" create-session="ifRequired">
    <remember-me key="foobarRememberKey" token-validity-seconds="2592000"/>
    <intercept-url pattern="/foobar/presentation" access="permitAll()"/>
    <intercept-url pattern="/foobar/tos" access="permitAll()"/>
    <intercept-url pattern="/foobar/license" access="permitAll()"/>
    <intercept-url pattern="/foobar/404-error" access="permitAll()"/>
    <intercept-url pattern="/foobar/500-error" access="permitAll()"/>
    <intercept-url pattern="/foobar/rest/users" method="POST" access="permitAll()"/>
    <intercept-url pattern="/metrics/**" access="hasRole('ROLE_ADMIN')"/>
    <intercept-url pattern="/**" access="isAuthenticated()"/>

    <form-login
            login-processing-url="/foobar/authentication"
            login-page="/foobar/login"
            authentication-failure-url="/foobar/login?action=loginFailure"
            default-target-url="/foobar/"
            authentication-success-handler-ref="foobarAuthenticationSuccessHandler"/>
    <http-basic/>
    <logout logout-url="/foobar/logout"
            logout-success-url="/foobar/login"/>

    <openid-login authentication-failure-url="/foobar/login?action=loginFailure"
                  user-service-ref="openIdAutoRegisteringUserDetailsService">
        <!-- Only Google Apps is supported -->
        <attribute-exchange identifier-match="https://www.google.com/.*">
            <openid-attribute name="email" type="http://axschema.org/contact/email" required="true" count="1"/>
            <openid-attribute name="firstname" type="http://axschema.org/namePerson/first" required="true"/>
            <openid-attribute name="lastname" type="http://axschema.org/namePerson/last" required="true"/>
        </attribute-exchange>
    </openid-login>
</http>

Answer 1

确保您已在 JSP 中包含 Spring Security 标记库：

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

在您的安全配置中包括：

<beans:bean class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"/>

然后使用authorize标签：

<sec:authorize access="isAuthenticated()">
   <!-- Content for Authenticated users -->  
</sec:authorize>

<sec:authorize access="isAnonymous()">
   <!-- Content for Unauthenticated users -->  
</sec:authorize>