Spring Security - Third Edition

The WebInvocationPrivilegeEvaluator class

There may be times when an application will not be written using JSPs and will need to be able to determine access based upon a URL, as we did with <... sec:authorize-url="/events/">. This can be done by using the o.s.s.web.access.WebInvocationPrivilegeEvaluator interface, which is the same interface that backs the JSP tag library. In the following code snippet, we demonstrate its use by populating our model with an attribute named showAdminLink. We are able to obtain WebInvocationPrivilegeEvaluator using the @Autowired annotation:

//src/main/java/com/packtpub/springsecurity/web/controllers/WelcomeController.java    @ModelAttribute (“showAdminLink”) public boolean showAdminLink(Authentication authentication) ...