title: How to authorize the menu from web page using the spring boot security sec:authorize-url or using EL expressions?
body: <p>I'm working on the spring boot security using basic authentication.I have configured basic application security layer and i can authenticate the user.But,now i would like to know how to authorize the user to show only the granted operations without hard coding the role names in client side or server side code using thymeleaf with spring security.</p>
  
  <p>Let's say i have app with some menus in dashboard to show the granted menus to the logged in user.I have read some thymeleaf tutorials by following this link <a href="https://github.com/thymeleaf/thymeleaf-extras-springsecurity" rel="nofollow">https://github.com/thymeleaf/thymeleaf-extras-springsecurity</a> but i could not get any samples to work using this.</p>
  
  <p>Could anyone help me to know about this scenario ?</p>
  
  <pre><code>import com.triesten.dost.*;
  import com.triesten.dost.customUserService.MyCustomUserDetailsService;
  import com.triesten.dost.dao.UserDao;
  import java.io.IOException;
  import javax.servlet.ServletException;
  import javax.servlet.http.HttpServletRequest;
  import javax.servlet.http.HttpServletResponse;
  import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.beans.factory.annotation.Qualifier;
  import org.springframework.boot.autoconfigure.security.SecurityProperties;
  import org.springframework.context.annotation.Bean;
  import org.springframework.core.annotation.Order;
  import org.springframework.security.access.AccessDeniedException;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.builders.WebSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.core.userdetails.UserDetailsService;
  import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  import org.springframework.security.crypto.password.PasswordEncoder;
  import org.springframework.security.web.access.AccessDeniedHandler;
  import org.springframework.security.web.csrf.CsrfFilter;
  import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
  
  @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
  public class ApplicationSecurity extends WebSecurityConfigurerAdapter {
  
      @Autowired
      UserDao userDao;
  
      @Autowired
      @Qualifier("userDetailsService")
      UserDetailsService userDetailsService;
  
      @Autowired
      private RESTAuthenticationEntryPoint authenticationEntryPoint;
  
      @Autowired
      private RESTAuthenticationFailureHandler authenticationFailureHandler;
      @Autowired
      private RESTAuthenticationSuccessHandler authenticationSuccessHandler;
  
      /*@Override
      public void configure(WebSecurity web) throws Exception {
          web
                  // Spring Security ignores request to static resources such as
                  // CSS or JS files.
                  .ignoring().antMatchers("/static/**");
      }*/
  
      @Override
      public void configure(WebSecurity web) throws Exception {
          web.ignoring().antMatchers("/css/**", "/fonts/**", "/images/**");
      }
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests().antMatchers("/", "/index.html", "/login", "/dost/bannerContent").permitAll();
          http.authorizeRequests().anyRequest().fullyAuthenticated().and().httpBasic().and().csrf().disable();
          http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint);
          http.formLogin().loginPage("/login").loginProcessingUrl("/login/authenticate")
                  .successHandler(authenticationSuccessHandler);
          http.formLogin().failureHandler(authenticationFailureHandler);
          http.logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessUrl("/login")
                  .invalidateHttpSession(true);
          http.exceptionHandling().accessDeniedHandler(accessDeniedHandler());
  
          // CSRF tokens handling
          http.addFilterAfter(new CsrfTokenResponseHeaderBindingFilter(), CsrfFilter.class);
      }
  
      /**
       * Configures the authentication manager bean which processes authentication
       * requests.
       */
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          // Dao based authentication
          auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
      }
  
      private AccessDeniedHandler accessDeniedHandler() {
          return new AccessDeniedHandler() {
  
              @Override
              public void handle(HttpServletRequest request, HttpServletResponse response,
                      AccessDeniedException accessDeniedException) throws IOException, ServletException {
                  response.getWriter().append("Access denied");
                  response.setStatus(403);
              }
          };
      }
  
      /**
       * This is used to hash the password of the user.
       */
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder(10);
      }
  
      /**
       * This bean is load the user specific data when form login is used.
       */
      @Bean
      public UserDetailsService userDetailsService() {
          return new MyCustomUserDetailsService(userDao);
      }
  }
  </code></pre>
  
  <p>Thanks in advance...</p>