org.springframework.expression.EvaluationException:
Access is forbidden for type 'org.springframework.web.servlet.support.ServletUriComponentsBuilder' in this expression context.
Thymeleaf 3.1.2 was released recently and is inluded in Spring Boot 3.0.10 and 3.1.3.
For security reasons, it is no longer allowed for a Thymeleaf template to directly access org.springframework.web.servlet.support.ServletUriComponentsBuilder
.
This was used in my Taming Thymeleaf book to build a generic fragment that can be used for pagination controls.
If you still use it, you get this exception while running the application:
org.springframework.expression.EvaluationException:
Access is forbidden for type 'org.springframework.web.servlet.support.ServletUriComponentsBuilder' in this expression context.
The way to fix this is exposing the ServletUriComponentsBuilder
as a Spring bean using @RequestScope
:
@Bean
@RequestScope
public ServletUriComponentsBuilder urlBuilder() {
return ServletUriComponentsBuilder.fromCurrentRequest();
}
You can now replace urlBuilder.fromCurrentRequest()
with @urlBuilder
in the template itself.
To view the changes in context, check out this commit on GitHub.
Using Thymeleaf 3.1.2 needs a small change to the demo application of Taming Thymeleaf, but should be easy to apply given the above explanation.
If you have any questions or remarks, feel free to post a comment at GitHub discussions.