sec:authorize in js append html as string not work

Question

I'm new to JS HTML JQuery ajax and I currently have an issue with my HTML case. To describe the most exactly what I'm facing right now first I'll talk about the process. The project is about SpringMVC + Thymeleaf & Thymeleaf Security5 + Spring Security.

The time the user logs in, the user with role USER won't see the tag by sec:acthorize, which works fine at first

The origin code work fine first when the user with role USER load into the page ( mean not show the tag for the user with role USER):

<tbody id="tableBody">
   <tr>
      <td>
         <a sec:authorize="hasAuthority('ADMIN')" href="#" th:attr="onclick='showConfirmationPopup(\'' + ${user.userName} + '\');'" class="delete" title="Delete" data-toggle="tooltip"></a>
      </td>
   </tr>
</tbody>

But then after I sort the table of content which call Ajax JQuery for recreate the view like this :

function populateTable(data) {
   $("#tableBody").empty();
   var row = $("<tr>");
   var actionColumn = $("<td>");
   actionColumn.append("<a sec:authorize=\"hasAuthority('ADMIN')\" href='/api/update/" + user.userName + "' class='settings' title='Update' data-toggle='tooltip'></a>");
   row.append(actionColumn);
   $("#tableBody").append(row);
}

And the result is it still shows the tag although the current authentication user has the role USER.

The code which calls the function above is:

   $.ajax({
      url: "/rest/api/pagination-by-search",
      type: "GET",
      data: formData,
      success: function(data) {
         populateTable(data);
      }
   });
   function populateTable(data) {
      $("#tableBody").empty();
      var row = $("<tr>");
      var actionColumn = $("<td>");
      actionColumn.append("<a sec:authorize=\"hasAuthority('ADMIN')\" href='/api/update/" + user.userName + "' class='settings' title='Update' data-toggle='tooltip'></a>");
      row.append(actionColumn);
      $("#tableBody").append(row);
   }

I tried to log the user's role, and it logs the role USER as expected. However, the view still shows for the user with role USER. The version I used:

SpringBoot version: 2.7.14
thymeleaf-extras-springsecurity5
java-version: 1.8

sec:authorize in js append html as string not work

0 Answers0