title: Spring Boot Security - Thymeleaf sec:authorize-url not working
body: <p>The <strong>sec:authorize-url</strong> Tag does not work with Spring boot security by default:</p>
  
  <pre><code>git clone https://github.com/spring-projects/spring-boot
  </code></pre>
  
  <h3>Project spring-boot-sample-web-method-security:</h3>
  
  <p>Add dependency</p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.thymeleaf.extras&lt;/groupId&gt;
      &lt;artifactId&gt;thymeleaf-extras-springsecurity3&lt;/artifactId&gt;
      &lt;version&gt;2.1.1.RELEASE&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>Adapt the controller from the sample:</p>
  
  <pre><code>@RequestMapping("/")
  public String home(Map&lt;String, Object&gt; model) {
  model.put("message", "Hello World");
  model.put("title", "Hello Home");
  model.put("date", new Date());
  return "home";
  }
  
  @RequestMapping("/admin/foo")
  public String home2(Map&lt;String, Object&gt; model) {
      model.put("message", "Hello World");
      model.put("title", "Hello Home");
      model.put("date", new Date());
      return "home";
  }
  </code></pre>
  
  <p>Add url matching to application security:</p>
  
  <pre><code>http.authorizeRequests().antMatchers("/login").permitAll()
      .antMatchers("/admin/**").hasRole("ADMIN")
  ...
  </code></pre>
  
  <p>Add testcode in home.html</p>
  
  <pre><code>&lt;div sec:authorize="hasRole('ROLE_ADMIN')"&gt;
      has role admin
   &lt;/div&gt;
   &lt;div sec:authorize-url="/admin/foo"&gt;
      can see /admin
   &lt;/div&gt;
  </code></pre>
  
  <p>When I start the app and login I will always see the "can see /admin" part no matter if I can actually access the url or not. The role evaluation itself works as expected, as does the url permission itself (I get a 403 when I try to access it with ROLE_USER).</p>
  
  <p>If I add a dummy privilegeEvaluator to the web security configuration that simply returns false for every request, the <em>div</em> will disappear correctly. </p>
  
  <p>Am I missing something here? Is this expected behaviour and what do I need to define to make authorize-url work that way it used to when configuring security with xml? </p>
  
  <h1>Update: Basic authentication</h1>
  
  <p>This issue is connected to Basic authentication and its AutoConfiguration in <strong>SpringBootWebSecurityConfiguration</strong>:</p>
  
  <p>In <strong>SampleMethodSecurityApplication</strong> change the ApplicationSecurity order by replacing:</p>
  
  <pre><code>@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  </code></pre>
  
  <p>with</p>
  
  <pre><code>@Order(SecurityProperties.BASIC_AUTH_ORDER + 1)
  </code></pre>
  
  <p>and deactivate basic in spring boot <strong>application.properties</strong></p>
  
  <pre><code>security.basic.enabled: false
  </code></pre>
  
  <p>Now the authorize-url tag will work as expected, but you have lost http basic AutoConfiguration of course. </p>
  
  <p>Leaving <strong>security.basic.enabled: true</strong> and changing the order of the ApplicationSecurity to be higher than BASIC_AUTH_ORDER will leave you with Basic authentication instead of form login...</p>
  
  <h1>Update - PrivilegeEvaluator</h1>
  
  <p>I have found the following workaround. Simply register the security interceptor manually in your SecurityConfig:</p>
  
  <pre><code>@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter {
  
      @Override
      public void configure(final WebSecurity web) throws Exception {
          final HttpSecurity http = getHttp();
          web.postBuildAction(new Runnable() {
              @Override
              public void run() {
                  web.securityInterceptor(http.getSharedObject(FilterSecurityInterceptor.class));
              }
          });
      }
  </code></pre>
  
  <p>It allows you to use the recommended ACCESS_OVERRIDE_ORDER and http basic auto configuration. I have posted more details <a href="https://github.com/spring-projects/spring-boot/issues/1319#issuecomment-56345581" rel="nofollow" title="here">here</a>
  Any explanation why this works is appreciated.</p>