title: Spring security JSP tags - which jars do I need?
body: <p>I have a project that used to run successfully on Spring 3.0 with Spring-MVC. I'm moving it to Spring 3.1 and at the same time changing my jar management to Maven rather than manual download/copy to project/lib for Ant.</p>
  
  <p>During loading the first (login) public page in the logs I see:
      INFO: At least one JAR was scanned for TLDs yet contained no TLDs</p>
  
  <p>Which makes me think one my taglib URLs isn't being matched to an appropriate taglib jar. So either the URL is incorrect or I don't have the appropriate jars.</p>
  
  <p>In the top of my JSP:</p>
  
  <pre><code>&lt;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %&gt;
  &lt;%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %&gt;
  &lt;%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %&gt;
  &lt;%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %&gt;
  &lt;%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %&gt;
  </code></pre>
  
  <p>I think it is the security tag that is having issues, as on the following page (after login) I get a new error:
      javax.servlet.ServletException: javax.servlet.jsp.JspException: java.io.IOException: No visible WebSecurityExpressionHandler instance could be found in the application context. There must be at least one in order to support expressions in JSP 'authorize' tags.</p>
  
  <p>This is new to me - <strike>I hadn't had to define a 'WebSecurityExpressionHandler' when I was running the app with Spring 3.0 libraries,</strike> so either I'm missing a jar that provides the relevant stuff or something has changed in Spring 3.0 -> 3.1 in how I should be configuring the security of my application.</p>
  
  <p>Edit:
  I've found what looks like it should fulfil that role in my config:</p>
  
  <pre><code>`&lt;bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler" /&gt;`
  </code></pre>
  
  <p>And 
      <code>&lt;http auto-config="true"  use-expressions="true"  .... &gt;</code> in my security-context.xml</p>