Use of sec:authorize to load javascript

Question

I'm making a development using Spring MVC and thymeleaf.
I'm trying to use sec:authorize to load javascript. In other words, I only want this script to load when the user is authenticated. Here is code I'm trying to get to work:

<script src="/js/jquery.min.js"
        th:src="@{/js/jquery.min.js}"></script>
        <script src="/js/submit.js"
        th:src="@{/js/submit.js}"></script>
        <script src="/js/url.js"
        th:src="@{/js/url.js}"></script>

        <!-- admin -->
        <script sec:authorize="isAuthenticated()" src="/js/jquery.simplemodal-1.4.4.js"
        th:src="@{/js/jquery.simplemodal-1.4.4.js}"></script>
        <script sec:authorize="isAuthenticated()" src="/js/admin.js"
        th:src="@{/js/admin.js}"></script>

These last 2 resources I'm trying to use sec:authorize to load but they seem to handle every time I load the page. Is this a valid way to use sec:authorize? Id it isn't, is there any way to do this?

Is this helpful to you? http://stackoverflow.com/questions/23348341/spring-security-and-thymeleaf-doesnt-work - probably you're missing some thymeleaf configuration — kamil, Jun 02 '15 at 21:36
Instead of using isAuthenticated() I used hasRole('ROLE_ADMIN') as posted on the link you provided and it worked. Should I delete my question? (new on stackoverflow). — Juan Carlos, Jun 02 '15 at 21:52

score 0 · Accepted Answer · edited Jun 20 '20 at 09:12

0

isAuthenticated() may be returning ROLE_ANONYMOUS which is a legit role, hence why its returning true and rendering your script.

here is a good explanation why user can be authenticated by anonymous (which in turn breaks your logic) Why is the 'anonymousUser' authenticated in Spring Security?

To circumvent that and specifically advise you want user with specific access there is a need for roles such as ROLE_USER, ROLE_ADMIN.

Hope that helps.

edited Jun 20 '20 at 09:12

Community

1
1

answered Jun 04 '15 at 06:06

Aeseir

7,754
10
58
107

Thank you, even though it worked I kept wondering why and this was very useful. The correct way to that would be: – Juan Carlos Jun 04 '15 at 14:47

Use of sec:authorize to load javascript

1 Answers1