However, I believe that we can also replace SecurityExpressionHandler<FilterInvocation> in favor of SecurityExpressionHandler<RequestAuthorizationContext> in the AbstractAuthorizeTag and JspAuthorizeTag classes.

However, there is a nuance: in FilterInvocation, if we pass request parameters, a DummyRequest is created that inherits from HttpServletRequestWrapper. We could introduce the same class and pass it to RequestAuthorizationContext. What do you think about this? Where should we place such a class? I think in our case it would be enough to copy it from FilterInvocation directly into AbstractAuthorizeTag.