Spring Security I / O

Question

I am using spring for my application. Listed below are some lines from my Context-Security.xml application to set access as ROLE_USER for / suggestions and / add links and there are no filters for the link / list.

<intercept-url pattern="/list*" filters="none" /> <intercept-url pattern="/offers**" access="ROLE_USER" /> <intercept-url pattern="/add/**" access="ROLE_USER" /> 

I want to show the LOGIN link when the user is not logged in and when the user logs in, then this link should be replaced with LOGOUT . For this, I tried the following code on my jsp page.

 <security:authorize ifNotGranted="ROLE_USER"> <a href="login.jsp">Login</a> </security:authorize> <security:authorize ifAnyGranted="ROLE_USER"> Welcome <security:authentication property="principal.username"/>! &nbsp; | <a href="logout.htm">Logout</a> </security:authorize> 

When I am in the list / list, it shows the "ENTRANCE" link. After logging in, if the user is redirected to / offers or / adds a link, he displays "Welcome UserName | LOGOUT", which works as requested. But the problem is that when a user logs in and redirects to the / list page, it also shows "LOGIN" (USER is already registered). It should show "Welcome UserName | LOGOUT"

Help me in this scenario: what should I do to make it work? Thank you in advance.

Answer 1

I found a solution that may be useful for others who are looking for the same question. Remove the line from the security XML file.

 <intercept-url pattern="/list*" filters="none" /> 

And the code will work. This is because when you point filters = "none" to a specific link, your context does not return the privileges granted to your jsp page. Therefore, when we are redirected to the list page after logging in, the authorize tag indicates that it is not authorized as ROLE_USER and executes the following lines,

 <security:authorize ifNotGranted="ROLE_USER"> <a href="login.jsp">Login</a> </security:authorize> 

So just remove the filter from this link.