Search code examples
javaspringspring-securityspring-el

SpEL - access session object in spring security

Is there a way to access session object within SpEL expression? Specifically I need it in spring security, something like

<intercept-url pattern="/somePage.html" access="session.getAttribute('someTemporaryFlag') != null" />

This code returns: EL1008E:(pos 0): Field or property 'session' cannot be found on object of type 'org.springframework.security.web.access.expression.WebSecurityExpressionRoot'. There's a related question to this one: List of Spring EL Variables but it doesn't answer my question.

Solution with security roles is not acceptable.

Solution

  • I don't think you have access to the session object directly but you can access request object and get session from it.

    <intercept-url pattern="/somePage.html" 
       access="request.session.getAttribute('someTemporaryFlag') != null" />