<?xml version="1.0" encoding="UTF-8" ?>
<!--
 ~ Copyright 2002-2014 the original author or authors.
 ~
 ~ Licensed under the Apache License, Version 2.0 (the "License");
 ~ you may not use this file except in compliance with the License.
 ~ You may obtain a copy of the License at
 ~
 ~      http://www.apache.org/licenses/LICENSE-2.0
 ~
 ~ Unless required by applicable law or agreed to in writing, software
 ~ distributed under the License is distributed on an "AS IS" BASIS,
 ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 ~ See the License for the specific language governing permissions and
 ~ limitations under the License.
-->
<taglib xmlns="http://java.sun.com/xml/ns/j2ee"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-jsptaglibrary_2_0.xsd"
        version="2.0">
    <description>Spring Security Authorization Tag Library</description>

    <tlib-version>4.0</tlib-version>
    <short-name>security</short-name>
    <uri>http://www.springframework.org/security/tags</uri>

    <tag>
        <description>
            A tag which outputs the body of the tag if the configured access expression
            evaluates to true for the currently authenticated principal.
        </description>
        <name>authorize</name>
        <tag-class>org.springframework.security.taglibs.authz.JspAuthorizeTag</tag-class>
        <body-content>JSP</body-content>

        <attribute>
            <description>
                A Spring-EL expression which is supported by the WebSecurityExpressionHandler
                in the application context. The latter will be used to evaluate the expression.
            </description>
            <name>access</name>
            <required>false</required>
            <rtexprvalue>true</rtexprvalue>
        </attribute>

        <attribute>
            <description>
                A URL within the application. If the user has access to this URL (as determined by
                the AccessDecisionManager), the tag body will be evaluated. If not, it will
                be skipped.
            </description>
            <name>url</name>
            <required>false</required>
            <rtexprvalue>true</rtexprvalue>
        </attribute>

        <attribute>
            <description>
                Can be used to specify the HTTP method (typically GET or POST) which is used in combination
                with the URL when consulting the AccessDecisionManager. Only has any meaning when used in combination
                with the "url" attribute. Defaults to GET.
            </description>
            <name>method</name>
            <required>false</required>
            <rtexprvalue>false</rtexprvalue>
        </attribute>

        <attribute>
            <description>
                A page scoped variable into which the boolean result of the tag evaluation will be written, allowing the
                same condition to be reused subsequently in the page without re-evaluation.
            </description>
            <name>var</name>
            <required>false</required>
            <rtexprvalue>false</rtexprvalue>
        </attribute>
    </tag>

    <tag>
        <description>
            Allows access to the current Authentication object.
        </description>
        <name>authentication</name>
        <tag-class>org.springframework.security.taglibs.authz.AuthenticationTag</tag-class>
        <body-content>empty</body-content>

        <attribute>
            <description>
                Property of the Authentication object which should be output. Supports nested
                properties. For example if the principal object is an instance of UserDetails,
                the property "principal.username" will return the username. Alternatively, using
                "name" will call getName method on the Authentication object directly.
            </description>
            <name>property</name>
            <required>true</required>
            <rtexprvalue>true</rtexprvalue>
        </attribute>
        <attribute>
            <description>
                Name of the exported scoped variable which will contain the
                evaluated property of the Authentication object.
            </description>
            <name>var</name>
            <required>false</required>
            <rtexprvalue>false</rtexprvalue>
        </attribute>
        <attribute>
            <description>
                Set HTML escaping for this tag, as a boolean value.
            </description>
            <name>htmlEscape</name>
            <required>false</required>
            <rtexprvalue>true</rtexprvalue>
        </attribute>
        <attribute>
            <description>
                Scope for var.
            </description>
            <name>scope</name>
            <required>false</required>
            <rtexprvalue>false</rtexprvalue>
        </attribute>
    </tag>

    <tag>
        <description>
            Allows inclusion of a tag body if the current Authentication
            has one of the specified permissions to the presented
            domain object instance.
        </description>
        <name>accesscontrollist</name>
        <tag-class>org.springframework.security.taglibs.authz.AccessControlListTag</tag-class>
        <body-content>JSP</body-content>

        <attribute>
            <description>
                A comma separated list of permissions, which will be converted to
                Permission instances by the configured PermissionFactory.
            </description>
            <name>hasPermission</name>
            <required>true</required>
            <rtexprvalue>true</rtexprvalue>
        </attribute>
        <attribute>
            <description>
                The actual domain object instance for which permissions
                are being evaluated.
            </description>
            <name>domainObject</name>
            <required>true</required>
            <rtexprvalue>true</rtexprvalue>
        </attribute>
        <attribute>
            <description>
                A page scoped variable into which the boolean result of the tag evaluation will be written, allowing the
                same condition to be reused subsequently in the page without re-evaluation.
            </description>
            <name>var</name>
            <required>false</required>
            <rtexprvalue>false</rtexprvalue>
        </attribute>
    </tag>

    <tag>
        <description><![CDATA[
            If CSRF protection is enabled, this tag inserts a hidden form field with the correct name and value for the
            CSRF protection token. If CSRF protection is not enabled, this tag outputs nothing. Normally Spring Security
            automatically inserts this form field for any <form:form> tags, but if for some reason you cannot use
            <form:form> this tag is a handy replacement. You should place this tag within an HTML <form></form> block,
            where you would normally place other <input>s. Do NOT place this tag within a Spring <form:form></form:form>
            block—Spring Security handles Spring forms automatically.
        ]]></description>
        <name>csrfInput</name>
        <tag-class>org.springframework.security.taglibs.csrf.CsrfInputTag</tag-class>
        <body-content>empty</body-content>
    </tag>

    <tag>
        <description><![CDATA[
            If CSRF protection is enabled, this tag inserts meta tags containing the CSRF protection token form
            field and header names and CSRF protection token value. These tags are useful for employing CSRF protection
            within JavaScript in your applications. You should place this tag within an HTML <head></head> block, where
            you would normally place other meta tags. Once you use this tag, you can access the form field name using
            the JQuery $("meta[name='_csrf_parameter']").attr("content") and the header name using
            $("meta[name='_csrf_header']").attr("content"). Likewise, you can access the token value with
            $("meta[name='_csrf']").attr("content"). You should use a form field when creating and submitting forms from
            JavaScript, and you should use a header when sending AJAX requests. If CSRF protection is not enabled, this
            tag outputs nothing.
        ]]></description>
        <name>csrfMetaTags</name>
        <tag-class>org.springframework.security.taglibs.csrf.CsrfMetaTagsTag</tag-class>
        <body-content>empty</body-content>
    </tag>

</taglib>
