title: Spring Security error before logging in
body: <p>I'm using thymeleaf 3.0.7 nad Spring security and trying to make a webapp. Logging and creating accounts runs well but before logging (viewing page as anonymous) i'm getting errors as below:</p>
  
  <pre><code>2018-07-24 21:09:19.124 [http-bio-8090-exec-7] ERROR org.thymeleaf.TemplateEngine - [THYMELEAF][http-bio-8090-exec-7] Exception processing template "error/general": An error happened during template parsing (template: "ServletContext resource [/WEB-INF/views/error/general.html]")
  org.thymeleaf.exceptions.TemplateInputException: An error happened during template parsing (template: "ServletContext resource [/WEB-INF/views/error/general.html]")
      at org.thymeleaf.templateparser.markup.AbstractMarkupTemplateParser.parse(AbstractMarkupTemplateParser.java:241)
      at org.thymeleaf.templateparser.markup.AbstractMarkupTemplateParser.parseStandalone(AbstractMarkupTemplateParser.java:100)
      at org.thymeleaf.engine.TemplateManager.parseAndProcess(TemplateManager.java:666)
      at org.thymeleaf.TemplateEngine.process(TemplateEngine.java:1098)
      at org.thymeleaf.TemplateEngine.process(TemplateEngine.java:1072)
      at org.thymeleaf.spring5.view.ThymeleafView.renderFragment(ThymeleafView.java:355)
      at org.thymeleaf.spring5.view.ThymeleafView.render(ThymeleafView.java:188)
      at org.springframework.web.servlet.DispatcherServlet.render(DispatcherServlet.java:1325)
      at org.springframework.web.servlet.DispatcherServlet.processDispatchResult(DispatcherServlet.java:1069)
      at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1008)
      at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:925)
      at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:978)
      at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:870)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
      at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:855)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
      at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:749)
      at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:489)
      at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:412)
      at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:339)
      at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:467)
      at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:338)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:203)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:100)
      at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
      at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1041)
      at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:603)
      at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:312)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at java.lang.Thread.run(Thread.java:748)
  Caused by: org.attoparser.ParseException: Exception evaluating SpringEL expression: "#authorization.expression('isAuthenticated()')" (template: "fragments/layout" - line 34, col 21)
      at org.attoparser.MarkupParser.parseDocument(MarkupParser.java:393)
      at org.attoparser.MarkupParser.parse(MarkupParser.java:257)
      at org.thymeleaf.templateparser.markup.AbstractMarkupTemplateParser.parse(AbstractMarkupTemplateParser.java:230)
      ... 34 common frames omitted
  Caused by: org.thymeleaf.exceptions.TemplateProcessingException: Exception evaluating SpringEL expression: "#authorization.expression('isAuthenticated()')" (template: "fragments/layout" - line 34, col 21)
      at org.thymeleaf.spring5.expression.SPELVariableExpressionEvaluator.evaluate(SPELVariableExpressionEvaluator.java:290)
      at org.thymeleaf.standard.expression.VariableExpression.executeVariableExpression(VariableExpression.java:165)
      at org.thymeleaf.standard.expression.SimpleExpression.executeSimple(SimpleExpression.java:66)
      at org.thymeleaf.standard.expression.Expression.execute(Expression.java:109)
      at org.thymeleaf.standard.expression.Expression.execute(Expression.java:138)
      at org.thymeleaf.standard.expression.NegationExpression.executeNegation(NegationExpression.java:149)
      at org.thymeleaf.standard.expression.ComplexExpression.executeComplex(ComplexExpression.java:86)
      at org.thymeleaf.standard.expression.Expression.execute(Expression.java:112)
      at org.thymeleaf.standard.expression.Expression.execute(Expression.java:138)
      at org.thymeleaf.standard.expression.Expression.execute(Expression.java:125)
      at org.thymeleaf.standard.processor.StandardIfTagProcessor.isVisible(StandardIfTagProcessor.java:59)
      at org.thymeleaf.standard.processor.AbstractStandardConditionalVisibilityTagProcessor.doProcess(AbstractStandardConditionalVisibilityTagProcessor.java:61)
      at org.thymeleaf.processor.element.AbstractAttributeTagProcessor.doProcess(AbstractAttributeTagProcessor.java:74)
      at org.thymeleaf.processor.element.AbstractElementTagProcessor.process(AbstractElementTagProcessor.java:95)
      at org.thymeleaf.util.ProcessorConfigurationUtils$ElementTagProcessorWrapper.process(ProcessorConfigurationUtils.java:633)
      at org.thymeleaf.engine.ProcessorTemplateHandler.handleOpenElement(ProcessorTemplateHandler.java:1314)
      at org.thymeleaf.engine.OpenElementTag.beHandled(OpenElementTag.java:205)
      at org.thymeleaf.engine.Model.process(Model.java:282)
      at org.thymeleaf.engine.ProcessorTemplateHandler.handleOpenElement(ProcessorTemplateHandler.java:1587)
      at org.thymeleaf.engine.TemplateHandlerAdapterMarkupHandler.handleOpenElementEnd(TemplateHandlerAdapterMarkupHandler.java:304)
      at org.thymeleaf.templateparser.markup.InlinedOutputExpressionMarkupHandler$InlineMarkupAdapterPreProcessorHandler.handleOpenElementEnd(InlinedOutputExpressionMarkupHandler.java:278)
      at org.thymeleaf.standard.inline.OutputExpressionInlinePreProcessorHandler.handleOpenElementEnd(OutputExpressionInlinePreProcessorHandler.java:186)
      at org.thymeleaf.templateparser.markup.InlinedOutputExpressionMarkupHandler.handleOpenElementEnd(InlinedOutputExpressionMarkupHandler.java:124)
      at org.attoparser.HtmlElement.handleOpenElementEnd(HtmlElement.java:109)
      at org.attoparser.HtmlMarkupHandler.handleOpenElementEnd(HtmlMarkupHandler.java:297)
      at org.attoparser.MarkupEventProcessorHandler.handleOpenElementEnd(MarkupEventProcessorHandler.java:402)
      at org.attoparser.ParsingElementMarkupUtil.parseOpenElement(ParsingElementMarkupUtil.java:159)
      at org.attoparser.MarkupParser.parseBuffer(MarkupParser.java:710)
      at org.attoparser.MarkupParser.parseDocument(MarkupParser.java:301)
      ... 36 common frames omitted
  Caused by: java.lang.IllegalArgumentException: Authentication object cannot be null
      at org.springframework.security.access.expression.SecurityExpressionRoot.&lt;init&gt;(SecurityExpressionRoot.java:61)
      at org.springframework.security.web.access.expression.WebSecurityExpressionRoot.&lt;init&gt;(WebSecurityExpressionRoot.java:36)
      at org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler.createSecurityExpressionRoot(DefaultWebSecurityExpressionHandler.java:43)
      at org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler.createSecurityExpressionRoot(DefaultWebSecurityExpressionHandler.java:33)
      at org.springframework.security.access.expression.AbstractSecurityExpressionHandler.createEvaluationContext(AbstractSecurityExpressionHandler.java:66)
      at org.thymeleaf.extras.springsecurity4.auth.AuthUtils.authorizeUsingAccessExpression(AuthUtils.java:194)
      at org.thymeleaf.extras.springsecurity4.auth.Authorization.expression(Authorization.java:103)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:498)
      at org.springframework.expression.spel.support.ReflectiveMethodExecutor.execute(ReflectiveMethodExecutor.java:120)
      at org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:106)
      at org.springframework.expression.spel.ast.MethodReference.access$000(MethodReference.java:52)
      at org.springframework.expression.spel.ast.MethodReference$MethodValueRef.getValue(MethodReference.java:359)
      at org.springframework.expression.spel.ast.CompoundExpression.getValueInternal(CompoundExpression.java:89)
      at org.springframework.expression.spel.ast.SpelNodeImpl.getValue(SpelNodeImpl.java:110)
      at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:334)
      at org.thymeleaf.spring5.expression.SPELVariableExpressionEvaluator.evaluate(SPELVariableExpressionEvaluator.java:263)
      ... 64 common frames omitted
  </code></pre>
  
  <p>Since it mentions /WEB-INF/views/error/general.html here it is:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html xmlns:th="www.thymeleaf.org"&gt;
  &lt;head&gt;
      &lt;title&gt;Error page&lt;/title&gt;
      &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/&gt;
      &lt;link href="../../../resources/css/bootstrap.min.css" rel="stylesheet" media="screen" th:href="@{/resources/css/bootstrap.min.css}"/&gt;
      &lt;link href="../../../resources/css/core.css" rel="stylesheet" media="screen" th:href="@{/resources/css/core.css}"/&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div class="container"&gt;
      &lt;div th:replace="fragments/layout :: header"&gt;&lt;/div&gt;
      &lt;div th:replace="fragments/components :: alert (type='danger', message=${errorMessage})"&gt;Error: Error&lt;/div&gt;
      &lt;div th:replace="fragments/layout :: footer"&gt;&lt;/div&gt;
  &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>And layout.html:</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.w3.org/1999/xhtml"&gt;
  &lt;head&gt;
      &lt;link href="../../../resources/css/bootstrap.min.css" rel="stylesheet" media="screen" th:href="@{/resources/css/bootstrap.min.css}"/&gt;
  &lt;/head&gt;
  &lt;body&gt;
  
  &lt;!-- Header --&gt;
  &lt;div class="navbar navbar-inverse navbar-fixed-top" th:fragment="header"&gt;
      &lt;div class="container"&gt;
          &lt;div class="navbar-header"&gt;
              &lt;button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".nav-collapse"&gt;
                  &lt;span class="icon-bar"&gt;&lt;/span&gt;
                  &lt;span class="icon-bar"&gt;&lt;/span&gt;
                  &lt;span class="icon-bar"&gt;&lt;/span&gt;
              &lt;/button&gt;
              &lt;a class="navbar-brand" href="#" th:href="@{/}"&gt;Demo project&lt;/a&gt;
          &lt;/div&gt;
          &lt;div class="navbar-collapse collapse"&gt;
              &lt;ul class="nav navbar-nav"&gt;
                  &lt;li th:classappend="${module == 'about' ? 'active' : ''}"&gt;
                      &lt;a href="#about" th:href="@{/about}"&gt;About&lt;/a&gt;
                  &lt;/li&gt;
                  &lt;li th:classappend="${module == 'calendar' ? 'active' : ''}"&gt;
                      &lt;a href="#calendar" th:href="@{/event}"&gt;Calendar&lt;/a&gt;
                  &lt;/li&gt;
                  &lt;li th:classappend="${module == 'event' ? 'active' : ''}"
                      sec:authorize="hasRole('ROLE_ADMIN')"
                  &gt;
                      &lt;a href="#event" th:href="@{/addEvent}"&gt;Formularz&lt;/a&gt;
                  &lt;/li&gt;
              &lt;/ul&gt;
              &lt;ul class="nav navbar-nav navbar-right"&gt;
                  &lt;li th:if="not ${#authorization.expression('isAuthenticated()')}"&gt;
                      &lt;a href="/signin" th:href="@{/signin}"&gt;
                          &lt;span class="glyphicon glyphicon-log-in" aria-hidden="true"&gt;&lt;/span&gt;&amp;nbsp;Sign in
                      &lt;/a&gt;
                  &lt;/li&gt;
                  &lt;li th:if="${#authorization.expression('isAuthenticated()')}"&gt;
                      &lt;a href="/logout" th:href="@{#}" onclick="$('#form').submit();"&gt;
                          &lt;span class="glyphicon glyphicon-log-out" aria-hidden="true"&gt;&lt;/span&gt;&amp;nbsp;Logout
                      &lt;/a&gt;
                      &lt;form style="visibility: hidden" id="form" method="post" action="#" th:action="@{/logout}"&gt;&lt;/form&gt;
                  &lt;/li&gt;
              &lt;/ul&gt;
          &lt;/div&gt;
          &lt;!--/.nav-collapse --&gt;
      &lt;/div&gt;
  &lt;/div&gt;
  
  &lt;!-- Footer --&gt;
  &lt;div th:fragment="footer" th:align="center"&gt;
      &amp;copy;&amp;nbsp;&lt;span th:text="${#temporals.format(#temporals.createNow(), 'yyyy')}"&gt;2017&lt;/span&gt;
      Demo project &lt;span th:text="${@environment.getProperty('app.version')}"&gt;&lt;/span&gt;
  &lt;/div&gt;
  
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>It says that line </p>
  
  <pre><code>&lt;li th:if="not ${#authorization.expression('isAuthenticated()')}"&gt;
  </code></pre>
  
  <p>is the problem and in fact when i change it to return false no errors are thrown. When i change it to use !isAuthenticated() or isAnonymous() instead of "not [...] isAuthenticated()" it throws errors. I have thymeleaf-extras-springsecurity4 dependency added in my pom.xml file as well.</p>
  
  <p>My bet is that i have to work on the fact the authenticated object is null. But what else it could be when i'm checking the website as anonymous?</p>