How to implement view-based spring security for links? - spring

Question

I have a new project and I want to implement spring-security along with other components of spring framekwork.
I plan to implement spring security into 2 levels, Request URL-level and view-level
For Request URL-Level, I'd use the <intercept-url> tag to restrict URL access only for authorized users.
For View-Level security, I'll use it into two parts of the application;
For the web app menu to restrict menus for users who authorized to.
And inside the pages to restrict some parts of the page for users who authorized to.
The confusion I had is regarding implement spring security for menu links.
Hence I need to use spring taglibs <authorize> tag's url attribute (to reuse<intercept-url> patterns/access combination) , then I'll need to write menu links by hand like this:
<security:authorize url="/admin/superadmin/**" >
Super admin page
</security:authorize>
Where I've the following intercept url rule:
<intercept-url pattern="/admin/superadmin/**" access="hasRole('ROLE_SUPER_ADMIN')" />
The point is, I have all the rules in the Database table, and I want to draw links dynamically based on the roles/links saved in the table.
So, the question is how to draw menu links dynamically, and at the same time still use the <authorize> taglib?

Answer 1

The <authorize> tag can do what you need automatically. I assume your menu JSP looks like (without the security part) :
<c:foreach items="${menus}" var="menu">
<a href=${menu.url}>${menu.label}</a>
</c:foreach>
You can simply add security that way :
<c:foreach items="${menus}" var="menu">
<security:authorize url=${menu.url}>
<a href=${menu.url}>${menu.label}</a>
</security:authorize>
</c:foreach>
The Spring security reference manual says that as you use the namespace the authorize tags creates a dummy web request for the supplied URL and invokes the security interceptor to see whether the request would succeed or fail. This allows you to delegate to the access-control setup you defined using intercept-url declarations within the namespace configuration and saves having to duplicate the information (such as the required roles) within your JSPs