Search code examples
springspring-securitythymeleaf

can sec:authorize from thymeleaf be used for multiple roles

So i have an element that i want to be accessible by both ADMIN and MODERATOR roles but not by regular users. I am using :

  <a class="dropdown-item" href="/addFishToWater" 
  sec:authorize="hasRole('ROLE_ADMIN')">Admin</a>

For single role check it works properly but is there a way to check for any of the roles ADMIN and MODERATOR.

Solution

  • Yes. You can use

    <a class="dropdown-item" href="/addFishToWater" 
  sec:authorize="hasAnyRole('ROLE_ADMIN', 'ROLE_MODERATOR')">Admin</a>

    More info about other options can be found in the official documentation.