title: Unable to hide links based on security
body: <p>I am trying to show links only if the user role is permitted. 
  But the links are not hidden and everything is shown for any roles. </p>
  
  <p>Seen so many similar queries here and none of the solution is working. Please advice what I'm missing. </p>
  
  <p>Configs.</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecConfig extends WebSecurityConfigurerAdapter{
  
      private final String USER = "USER";
      private final String ADMIN = "ADMIN";
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.authorizeRequests()
                  .antMatchers("/").hasAnyRole(USER, ADMIN)
                  .antMatchers("/closed").hasRole(ADMIN).and()
                  .formLogin().defaultSuccessUrl("/");
      }
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.inMemoryAuthentication()
                  .withUser("jane").password(passwordEncoder().encode("qwe")).roles(ADMIN, USER).and()
                  .withUser("john").password(passwordEncoder().encode("qwe")).roles(USER);
      }
  
      @Bean
      public BCryptPasswordEncoder passwordEncoder(){
          return new BCryptPasswordEncoder();
      }
  }
  </code></pre>
  
  <p>POM</p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.thymeleaf.extras&lt;/groupId&gt;
      &lt;artifactId&gt;thymeleaf-extras-springsecurity4&lt;/artifactId&gt;
  &lt;/dependency&gt;
  
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
  &lt;/dependency&gt;
  &lt;dependency&gt;
      &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
      &lt;artifactId&gt;spring-boot-starter-thymeleaf&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>HTML</p>
  
  <pre><code>&lt;a th:href="@{/closed}"&gt;Go to closed&lt;/a&gt;
  
  &lt;br/&gt;&lt;br/&gt;
  
  &lt;form th:action="@{/logout}" method="post"&gt;
      &lt;input type="submit" value="Log out"&gt;
  &lt;/form&gt;
  
  &lt;br/&gt;
  
  &lt;h2&gt;Welcome&lt;/h2&gt;
  &lt;p&gt;Spring Security Thymeleaf&lt;/p&gt;
  &lt;div sec:authorize="hasRole('USER')"&gt;Text visible to user.&lt;/div&gt;
  &lt;div sec:authorize="hasRole('ADMIN')"&gt;Text visible to admin.&lt;/div&gt;
  &lt;div sec:authorize="isAuthenticated()"&gt;
      Text visible only to authenticated users.
  &lt;/div&gt;
  Authenticated username:
  &lt;div sec:authentication="name"&gt;&lt;/div&gt;
  Authenticated user roles:
  &lt;div sec:authentication="principal.authorities"&gt;&lt;/div&gt;
  </code></pre>
  
  <p>Everything above is displayed for Jane even though she has no admin access. Plus even her roles and username is not displayed either. </p>
  
  <p>I also tried configuring the dialect as follows which makes no difference. </p>
  
  <pre><code>@Configuration
  public class LeafConfig {
  
      @Bean
      public SpringSecurityDialect springSecurityDialect(){
          return new SpringSecurityDialect();
      }
  }
  </code></pre>
  
  <p>The following is whats displayed for Jane or John., No difference: </p>
  
  <pre><code>Welcome
  Spring Security Thymeleaf
  
  Text visible to user.
  Text visible to admin.
  Text visible only to authenticated users.
  Authenticated username:
  Authenticated user roles:
  </code></pre>