I have simmiliar issue before where sec:authentication="name" not working for me. After read https://github.com/thymeleaf/thymeleaf-extras-springsecurity/tree/3.1-master?tab=readme-ov-file, in order to solve that we need org.thymeleaf.extras.springsecurity5.dialect.SpringSecurityDialect or org.thymeleaf.extras.springsecurity6.dialect.SpringSecurityDialect, and we need configure this dialect on our configuration file.

Here my configuration file:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.thymeleaf.extras.springsecurity6.dialect.SpringSecurityDialect;
import org.thymeleaf.spring6.SpringTemplateEngine;
import org.thymeleaf.spring6.templateresolver.SpringResourceTemplateResolver;
import org.thymeleaf.spring6.view.ThymeleafViewResolver;

@Configuration
public class ThymeleafConfig {

    @Bean
    public SpringSecurityDialect springSecurityDialect() {
        return new SpringSecurityDialect();
    }

    @Bean
    public SpringResourceTemplateResolver templateResolver() {
        SpringResourceTemplateResolver templateResolver = new SpringResourceTemplateResolver();
        templateResolver.setPrefix("classpath:/templates/");
        templateResolver.setSuffix(".html");
        templateResolver.setCacheable(false);
        return templateResolver;
    }

    @Bean
    public SpringTemplateEngine templateEngine() {
        SpringTemplateEngine templateEngine = new SpringTemplateEngine();
        templateEngine.setTemplateResolver(templateResolver());
        templateEngine.addDialect(springSecurityDialect());

        return templateEngine;
    }

    @Bean
    public ThymeleafViewResolver thymeleafViewResolver() {
        ThymeleafViewResolver viewResolver = new ThymeleafViewResolver();
        viewResolver.setTemplateEngine(templateEngine());
        return viewResolver;
    }
}

And here my example code on my html:

<li class="nav-item">
    <a class="nav-link" sec:authorize="isAuthenticated()" th:href="@{/orders}">Orders</a>
</li>

And all working, Unauthenticated User: Unauthenticated User

Authenticated User: Authenticated User