Spring security JSP tags - which jars do I need?

Question

I have a project that used to run successfully on Spring 3.0 with Spring-MVC. I'm moving it to Spring 3.1 and at the same time changing my jar management to Maven rather than manual download/copy to project/lib for Ant.

During loading the first (login) public page in the logs I see: INFO: At least one JAR was scanned for TLDs yet contained no TLDs

Which makes me think one my taglib URLs isn't being matched to an appropriate taglib jar. So either the URL is incorrect or I don't have the appropriate jars.

In the top of my JSP:

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %>
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>

I think it is the security tag that is having issues, as on the following page (after login) I get a new error: javax.servlet.ServletException: javax.servlet.jsp.JspException: java.io.IOException: No visible WebSecurityExpressionHandler instance could be found in the application context. There must be at least one in order to support expressions in JSP 'authorize' tags.

This is new to me - I hadn't had to define a 'WebSecurityExpressionHandler' when I was running the app with Spring 3.0 libraries, so either I'm missing a jar that provides the relevant stuff or something has changed in Spring 3.0 -> 3.1 in how I should be configuring the security of my application.

Edit: I've found what looks like it should fulfil that role in my config:

`<bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler" />`

And <http auto-config="true" use-expressions="true" .... > in my security-context.xml

Answer 1

You should have at least the following ones:

• spring-security-config
• spring-security-web
• spring-security-taglibs

additionally you can add spring-security-core but Maven should resolve it as a transitive dependency.