Mocking is an essential part of unit testing, and the Mockito library makes it easy to write clean and intuitive unit tests for your Java code.
Get started with mocking and improve your application tests using our Mockito guide:
Handling concurrency in an application can be a tricky process with many potential pitfalls. A solid grasp of the fundamentals will go a long way to help minimize these issues.
Get started with understanding multi-threaded applications with our Java Concurrency guide:
Spring 5 added support for reactive programming with the Spring WebFlux module, which has been improved upon ever since. Get started with the Reactor project basics and reactive programming in Spring Boot:
Since its introduction in Java 8, the Stream API has become a staple of Java development. The basic operations like iterating, filtering, mapping sequences of elements are deceptively simple to use.
But these can also be overused and fall into some common pitfalls.
To get a better understanding on how Streams work and how to combine them with other language features, check out our guide to Java Streams:
Explore Spring Boot 3 and Spring 6 in-depth through building a full REST API with the framework:
Yes, Spring Security can be complex, from the more advanced functionality within the Core to the deep OAuth support in the framework.
I built the security material as two full courses - Core and OAuth, to get practical with these more complex scenarios. We explore when and how to use each feature and code through it on the backing project.
You can explore the course here:
Spring Data JPA is a great way to handle the complexity of JPA with the powerful simplicity of Spring Boot.
Get started with Spring Data JPA through the guided reference course:
Refactor Java code safely — and automatically — with OpenRewrite.
Refactoring big codebases by hand is slow, risky, and easy to put off. That’s where OpenRewrite comes in. The open-source framework for large-scale, automated code transformations helps teams modernize safely and consistently.
Each month, the creators and maintainers of OpenRewrite at Moderne run live, hands-on training sessions — one for newcomers and one for experienced users. You’ll see how recipes work, how to apply them across projects, and how to modernize code with confidence.
Join the next session, bring your questions, and learn how to automate the kind of work that usually eats your sprint time.
Yes, we're now running our only Summer Sale. All Courses are 30% off until 20th July, 2026:
Yes, we're now running our only Summer Sale. All Courses are 30% off until 20th July, 2026:
1. Overview
In this tutorial, we’ll take a look at Spring Security Taglibs, which provides basic support for accessing security information and applying security constraints in JSPs.
2. Maven Dependencies
First of all, let’s add the spring-security-taglibs dependency to our pom.xml:
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-taglibs</artifactId>
<version>6.1.5</version>
</dependency>3. Declaring the Taglibs
Now, before we can use the tags, we need to import the taglib at the top of our JSP file:
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>After adding this, we’ll be able to specify Spring Security’s tags with the sec prefix.
4. The authorize Tag
4.1. access Expressions
In our applications, we might have information which should be shown only for certain roles or users.
When this is the case, we can use the authorize tag:
<sec:authorize access="!isAuthenticated()">
Login
</sec:authorize>
<sec:authorize access="isAuthenticated()">
Logout
</sec:authorize>Furthermore, we can check if an authenticated user has specific roles:
<sec:authorize access="hasRole('ADMIN')">
Manage Users
</sec:authorize>And we can use any Spring Security expression as our value for access:
- hasAnyRole(‘ADMIN’,’USER’) returns true if the current user has any of the listed roles
- isAnonymous() returns true if the current principal is an anonymous user
- isRememberMe() returns true if the current principal is a remember-me user
- isFullyAuthenticated() returns true if the user is authenticated and is neither anonymous nor a remember-me user
4.2. url
Other than that, we can check for users who are authorized to send requests to the certain URLs:
<sec:authorize url="/userManagement">
<a href="/userManagement">Manage Users</a>
</sec:authorize>4.3. Debugging
There may be cases where we want more control over the UI, for example in testing scenarios. Instead of having Spring Security skip rendering these unauthorized sections, we can set spring.security.disableUISecurity=true in, say, our application.properties file.
When we do this, the authorize tag won’t hide its contents. Instead, it will wrap the content with <span class=”securityHiddenUI”>… </span> tags instead. Then, we can customize the rendering ourselves with some CSS.
Remember though that hiding content via CSS isn’t secure! The user can simply view the source to see unauthorized content.
5. The authentication Tag
At other times, we’ll want to display details about the logged in user, like saying something like “Welcome Back, Carol!” on the site.
For this, we use the authentication tag:
<sec:authorize access="isAuthenticated()">
Welcome Back, <sec:authentication property="name"/>
</sec:authorize>6. The csrfInput Tag
Hopefully, we have Spring Security’s CSRF defense enabled in our app!
If we do, then Spring Security already inserts a CSRF hidden form input inside <form:form> tags for us.
But in case we want to use <form> instead, we can manually indicate where Spring Security should place this hidden input field using csrfInput:
<form method="post" action="/do/something">
<sec:csrfInput />
Text Field:<br />
<input type="text" name="textField" />
</form>If CSRF protection is not enabled, this tag outputs nothing.
7. The csrfMetaTags Tag
Or, if we’re wanting to access the CSRF token in Javascript, we’ll probably want to insert the token as a meta tag.
We can do this with the csrfMetaTags tag:
<html>
<head>
<title>JavaScript with CSRF Protection</title>
<sec:csrfMetaTags />
<script type="text/javascript" language="javascript">
var csrfParameter = $("meta[name='_csrf_parameter']").attr("content");
var csrfHeader = $("meta[name='_csrf_header']").attr("content");
var csrfToken = $("meta[name='_csrf']").attr("content");
</script>
</head>
<body>
...
</body>
</html>Again, if CSRF protection isn’t enabled, this tag won’t output anything.
8. Conclusion
In this quick article, we focused on some common Spring Security taglib use-cases.
And, as we learned, they are very useful for rendering authentication and authorization-aware JSP content.
