Thymeleaf Spring Security Dialect失效，登录后权限标签内容全部显示

登录进入主页后，所有权限相关内容都被显示，sec标签未生效，已配置认证与授权，排查方向如下：

主页代码 #

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org"
                xmlns:sec="https://www.thymeleaf.org/thymeleaf-extras-springsecurity5">
<head>
    <meta charset="UTF-8" >
    <title>Main page</title>
</head>
<body>
    <h1>Wellcome</h1>
    <sec:authorize access="hasAuthority('ROLE_ADMIN')">
        <h4>You have all possibilities!</h4>
    </sec:authorize>
    <sec:authorize access="isAuthenticated()">
    <h1>You are login</h1>
    </sec:authorize>
    <sec:authorize access="!isAuthenticated()">
        <h1>You are not login</h1>
    </sec:authorize>
</body>
</html>

Maven依赖配置 #

<properties>
    <maven.compiler.source>17</maven.compiler.source>
    <maven.compiler.target>17</maven.compiler.target>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

    <spring.version>5.3.14</spring.version>
    <security.version>5.3.13.RELEASE</security.version>
</properties>

<name>lab_6 Maven Webapp</name>
<url>http://maven.apache.org</url>
<dependencies>
    <!-- Spring Core -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>${spring.version}</version>
    </dependency>

    <!-- Spring Context -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-context</artifactId>
        <version>${spring.version}</version>
    </dependency>

    <!-- Spring Web -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-web</artifactId>
        <version>${spring.version}</version>
    </dependency>

    <!-- Spring WebMVC -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-webmvc</artifactId>
        <version>${spring.version}</version>
    </dependency>

    <!-- Thymeleaf Spring5 -->
    <dependency>
        <groupId>org.thymeleaf</groupId>
        <artifactId>thymeleaf-spring5</artifactId>
        <version>3.1.2.RELEASE</version>
    </dependency>

    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-context-support</artifactId>
        <version>${spring.version}</version>
    </dependency>

    <!-- Spring Security Web -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>${security.version}</version>
    </dependency>

    <!-- Spring Security Config -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
        <version>${security.version}</version>
    </dependency>

    <!-- Spring Security Core -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-core</artifactId>
        <version>${security.version}</version>
    </dependency>

    <!-- Spring Security Crypto -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-crypto</artifactId>
        <version>${security.version}</version>
    </dependency>

    <!-- Spring Security OAuth2 Client -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-oauth2-client</artifactId>
        <version>${security.version}</version>
    </dependency>

    <!-- Servlet API -->
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>javax.servlet-api</artifactId>
        <version>4.0.1</version>
        <scope>provided</scope>
    </dependency>

    <!-- Spring JDBC -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-jdbc</artifactId>
        <version>6.0.12</version>
    </dependency>

    <!-- PostgreSQL Driver -->
    <dependency>
        <groupId>org.postgresql</groupId>
        <artifactId>postgresql</artifactId>
        <version>42.6.0</version>
    </dependency>

    <!-- Validation API -->
    <dependency>
        <groupId>javax.validation</groupId>
        <artifactId>validation-api</artifactId>
        <version>2.0.1.Final</version>
    </dependency>

    <!-- Hibernate Validator -->
    <dependency>
        <groupId>org.hibernate.validator</groupId>
        <artifactId>hibernate-validator</artifactId>
        <version>6.0.22.Final</version>
    </dependency>

    <!-- Thymeleaf Extras Spring Security5 -->
    <dependency>
        <groupId>org.thymeleaf.extras</groupId>
        <artifactId>thymeleaf-extras-springsecurity5</artifactId>
        <version>3.0.4.RELEASE</version>
    </dependency>
</dependencies>

WebConfig配置 #

@Configuration
@EnableWebMvc
@ComponentScan("org.example.lab_6")
public class WebConfig implements WebMvcConfigurer {


    private final ApplicationContext applicationContext;


    @Autowired
    public WebConfig(ApplicationContext applicationContext) {
        this.applicationContext = applicationContext;
    }


    @Bean
    public SpringResourceTemplateResolver templateResolver() {
        SpringResourceTemplateResolver templateResolver = new
                SpringResourceTemplateResolver();
        templateResolver.setApplicationContext(applicationContext);
        templateResolver.setPrefix("/WEB-INF/views/");
        templateResolver.setSuffix(".html");
        templateResolver.setCharacterEncoding("UTF-8");
        return templateResolver;
    }


    @Bean
    public SpringTemplateEngine templateEngine() {
        SpringTemplateEngine templateEngine = new SpringTemplateEngine();
        templateEngine.setTemplateResolver(templateResolver());
        templateEngine.addDialect(new SpringSecurityDialect());
        templateEngine.setEnableSpringELCompiler(true);
        return templateEngine;
    }

 
    @Override
    public void configureViewResolvers(ViewResolverRegistry registry) {
        ThymeleafViewResolver resolver = new ThymeleafViewResolver();
        resolver.setTemplateEngine(templateEngine());
        resolver.setCharacterEncoding("UTF-8");
        registry.viewResolver(resolver);
    }

}

可能的原因及解决方法 #

• 依赖版本不兼容：thymeleaf-spring5使用3.1.2.RELEASE，而thymeleaf-extras-springsecurity5用的是3.0.4.RELEASE，两者版本不匹配。thymeleaf-extras-springsecurity5 3.0.x仅兼容Thymeleaf 3.0.x，需将dialect版本升级到3.1.2.RELEASE，与Thymeleaf版本保持一致。
• Spring组件版本冲突：spring-jdbc使用6.0.12，而其他Spring组件版本是5.3.14，Spring 6与Spring 5存在兼容性问题，会导致上下文异常，进而影响Security上下文传递。将spring-jdbc版本改为${spring.version}，统一Spring版本。
• Security过滤器链未生效：确保Spring Security配置类添加@EnableWebSecurity注解，并且正确配置HttpSecurity，保证所有请求都经过Security过滤器，否则SecurityContextHolder无法获取认证信息，sec标签无法正常解析。
• 缓存问题：清理浏览器缓存、项目target目录，重新编译构建，避免旧缓存导致标签未被正确解析。

内容的提问来源于stack exchange，提问作者Nitrolacs