Best practice using hasPermissions with model attributes

[hopperd]

Currently it seems to properly access model attributes when using the PermissionEvaluator you have to explicitly do it like so. sec:authorize="hasPermission(#request.getAttribute('organization'), 'update:contacts')"

I would have thought something like sec:authorize="hasPermission(#organization, 'update:contacts')"

Would have worked but seems to always evaluate to null. Though using the same in pre-authorize annotations (method level) works just fine.

[hopperd]

@danielfernandez any suggestion here?

[danielfernandez]

The sec:authorize attribute tries to mimic the behaviour of Spring Security's original JSP tag library, and the way expressions are executed in them. And the expressions executed for Spring Security's tags are not executed on the root context that would be used for the rest of the templates, but in their own, security-specific context. That's why the available objects are not the same…

So basically, Thymeleaf is here just mirroring the behaviour expected for Spring Security users in other environments.

[hasancansaral]

@danielfernandez In that case, I have checked that one can use:

sec:authorize="hasPermission('id', 'type', 'ADMINISTRATION')"

but how can I render id dynamically based on some ${obj}?