0

In my current spring-boot project, the header for my views have the following instruction:

<a sec:authorize="hasRole('admin')" th:href="@{/home}">...</a>

which is not working when I run the application and open the view in the browser (even when the user has the role). In the same view, I also use sec:authorize="isAuthenticated()" and sec:authorize="isAnonymous()", both working fine. In my java code, I have some methods with this annotation:

@PreAuthorize("hasRole('admin')")

which working fine, too. Why this is not working in the view? Anyone can tell me what's wrong here?

Kleber Mota
  • 8,111
  • 29
  • 86
  • 174

2 Answers2

0

Because you must add a "ROLE_" before your rolename.

Like this:

sec:authorize="hasRole('ROLE_admin')"
Kalaschni
  • 2,080
  • 21
  • 34
0

The ROLE_ prefix should not be necessary as of Spring 3 I believe.

Try using hasAuthority('admin') instead of hasRole(). The difference between the two is descriped in this post

Community
  • 1
  • 1
randyr
  • 1,539
  • 9
  • 17