Package com.vaadin.flow.spring.security

Class VaadinSecurityConfigurer

java.lang.Object
org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>
org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<VaadinSecurityConfigurer,org.springframework.security.config.annotation.web.builders.HttpSecurity>
com.vaadin.flow.spring.security.VaadinSecurityConfigurer
All Implemented Interfaces:
org.springframework.security.config.annotation.SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>
public final class VaadinSecurityConfigurer extends org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<VaadinSecurityConfigurer,org.springframework.security.config.annotation.web.builders.HttpSecurity>
A SecurityConfigurer specifically designed for Vaadin applications.

Provides built-in customizers to configure the security settings for Flow and Hilla by integrating with Spring Security and specialized methods to handle view access control and default security workflows in Vaadin applications.

Usage example: 

 
 @Configuration
 @EnableWebSecurity
 public class MyWebSecurity {

     @Bean
     SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
         return http.with(VaadinSecurityConfigurer.vaadin(), configurer -> {
             configurer.loginView(MyLoginView.class);
         }).build();
     }
 }

Configurers

This configurer applies other configurers to set up the security filter chain properly for Vaadin applications. The following configurers may be applied:

Shared Objects

The following beans are shared by this configurer (if not already shared):

Since:
24.8

  • Method Details

    • vaadin

      public static VaadinSecurityConfigurer vaadin()
      Creates a new instance the VaadinSecurityConfigurer that can be used to configure security settings for Vaadin applications.
      Returns:
      a new instance of VaadinSecurityConfigurer

    • loginView

      public VaadinSecurityConfigurer loginView(Class<? extends Component> loginView)
      Configures the login view for use in a Flow application.

      This method ensures that the provided login view class is annotated with @Route, retrieves the route path for the login view, and sets up the necessary configurations for login and logout paths.

      Parameters:
      loginView - the component class to be used as the login view
      Returns:
      the current configurer instance for method chaining
      Throws:
      IllegalArgumentException - if the provided class is not annotated with @Route

    • loginView

      public VaadinSecurityConfigurer loginView(Class<? extends Component> loginView, String logoutSuccessUrl)
      Configures the login view for use in a Flow application and the logout success URL.

      This method ensures that the provided login view class is annotated with @Route, retrieves the route path for the login view, and sets up the necessary configurations for login and logout paths.

      Parameters:
      loginView - the component class to be used as the login view
      logoutSuccessUrl - the URL to redirect to upon a successful logout
      Returns:
      the current configurer instance for method chaining
      Throws:
      IllegalArgumentException - if the provided class is not annotated with @Route

    • loginView

      public VaadinSecurityConfigurer loginView(String loginView)
      Configures the login view for use in a Hilla application.

      This is used when your application uses a Hilla-based login view that is available at the given path.

      If the path points to a Flow view, the corresponding Java class must be annotated with AnonymousAllowed to ensure that the view is always accessible.

      Parameters:
      loginView - the path to the login view
      Returns:
      the current configurer instance for method chaining

    • loginView

      public VaadinSecurityConfigurer loginView(String loginView, String logoutSuccessUrl)
      Configures the login view for use in a Hilla application and the logout success URL.

      This is used when your application uses a Hilla-based login view that is available at the given path.

      If the path points to a Flow view, the corresponding Java class must be annotated with AnonymousAllowed to ensure that the view is always accessible.

      Parameters:
      loginView - the path to the login view
      logoutSuccessUrl - the URL to redirect to upon a successful logout
      Returns:
      the current configurer instance for method chaining

    • oauth2LoginPage

      public VaadinSecurityConfigurer oauth2LoginPage(String oauth2LoginPage)
      Configures the login page for OAuth2 authentication.

      If using Spring's OAuth2 client, this should be set to Spring's internal redirect endpoint /oauth2/authorization/{registrationId} where registrationId is the ID of the OAuth2 client registration.

      This method also configures a logout success handler that redirects to the application base URL after logout.

      Parameters:
      oauth2LoginPage - the login page for OAuth2 authentication
      Returns:
      the current configurer instance for method chaining

    • oauth2LoginPage

      public VaadinSecurityConfigurer oauth2LoginPage(String oauth2LoginPage, String postLogoutRedirectUri)
      Configures the login page for OAuth2 authentication and the post-logout redirect URI.

      If using Spring's OAuth2 client, this should be set to Spring's internal redirect endpoint /oauth2/authorization/{registrationId} where registrationId is the ID of the OAuth2 client registration.

      The {baseUrl} placeholder is also supported, which is the same as {baseScheme}://{baseHost}{basePort}{basePath}.

      Parameters:
      oauth2LoginPage - the login page for OAuth2 authentication
      postLogoutRedirectUri - the URI to redirect to after the user logs out
      Returns:
      the current configurer instance for method chaining

    • keycloakRoleMapping

      public VaadinSecurityConfigurer keycloakRoleMapping()
      Enables mapping of Keycloak realm and client roles to Spring Security granted authorities (disabled by default).

      Keycloak puts the roles of a user into the access token, so they are not part of the authenticated user by default. This opts in to decoding the access token and mapping its roles, which makes @RolesAllowed("admin") and hasRole("admin") match a Keycloak role named admin. See KeycloakOidcUserMapper for what exactly is mapped.

      Works only together with oauth2LoginPage(String) and its overloads, and sets the OidcUserService that this security filter chain uses to load the authenticated user. An application that has its own OidcUserService should leave this off and install the mapper on that service instead, as KeycloakOidcUserMapper shows.

      Returns:
      the current configurer instance for method chaining
      Since:
      25.4
      See Also:

    • defaultSuccessUrl

      public VaadinSecurityConfigurer defaultSuccessUrl(String defaultSuccessUrl)
      Sets the default success URL after authentication. Redirected only when no protected page was previously accessed. Works only together with loginView(String) or oauth2LoginPage(String) and their variants.
      Parameters:
      defaultSuccessUrl - the default success url
      Returns:
      the current configurer instance for method chaining
      Since:
      24.9.8
      See Also:

    • defaultSuccessUrl

      public VaadinSecurityConfigurer defaultSuccessUrl(String defaultSuccessUrl, boolean alwaysUse)
      Sets the default success URL after authentication. If alwaysUse is true, always redirects to this URL; otherwise, only when no protected page was previously accessed. Works only together with loginView(String) or oauth2LoginPage(String) and their variants.
      Parameters:
      defaultSuccessUrl - the default success url
      alwaysUse - if true, always redirect to defaultSuccessUrl after authentication, even when a protected page was previously accessed
      Returns:
      the current configurer instance for method chaining
      Since:
      24.9.8

    • successUrlResolver

      public VaadinSecurityConfigurer successUrlResolver(VaadinSavedRequestAwareAuthenticationSuccessHandler.SuccessUrlResolver successUrlResolver)
      Sets the resolver for the URL to redirect to after authentication, for example to send users to a landing page that depends on their roles. When the resolver returns a URL, it takes precedence over both the previously accessed page and the default success URL. When it returns null, the user is redirected as if no resolver was set. Works only together with loginView(String) or oauth2LoginPage(String) and their variants.

      Usage example: 

       
 configurer.loginView(LoginView.class).successUrlResolver(
         (request, authentication, savedUrl) -> authentication
                 .getAuthorities().stream()
                 .anyMatch(a -> "ROLE_ADMIN".equals(a.getAuthority()))
                         ? "/admin"
                         : null);
      Parameters:
      successUrlResolver - the resolver for the URL to redirect to after authentication
      Returns:
      the current configurer instance for method chaining
      See Also:

    • failureHandler

      public VaadinSecurityConfigurer failureHandler(org.springframework.security.web.authentication.AuthenticationFailureHandler failureHandler)
      Configures the handler for a failed authentication, for example to audit failed login attempts or to redirect to a custom error page.

      This overrides the default behavior of redirecting back to the login view with an error parameter. Works only together with loginView(String) or oauth2LoginPage(String) and their variants.

      If the handler redirects to a URL other than the login view, access to that URL must be permitted explicitly, as it is otherwise denied by the default authorization rules and the user ends up back on the login view without seeing the error.

      For auditing only, listening to Spring Security's AbstractAuthenticationFailureEvent is an alternative that keeps the default behavior.

      Parameters:
      failureHandler - the authentication failure handler
      Returns:
      the current configurer instance for method chaining

    • logoutSuccessHandler

      public VaadinSecurityConfigurer logoutSuccessHandler(org.springframework.security.web.authentication.logout.LogoutSuccessHandler logoutSuccessHandler)
      Configures the handler for a successful logout.

      This overrides the default handler configured automatically with either loginView(Class) or oauth2LoginPage(String) (and their overloads).

      Parameters:
      logoutSuccessHandler - the logout success handler
      Returns:
      the current configurer instance for method chaining

    • addLogoutHandler

      public VaadinSecurityConfigurer addLogoutHandler(org.springframework.security.web.authentication.logout.LogoutHandler logoutHandler)
      Adds a LogoutHandler to the list of logout handlers.
      Parameters:
      logoutHandler - the logout handler to be added
      Returns:
      the current configurer instance for method chaining

    • enableCsrfConfiguration

      public VaadinSecurityConfigurer enableCsrfConfiguration(boolean enableCsrfConfiguration)
      Enables or disables automatic CSRF configuration (enabled by default).

      This configurer will automatically configure Spring's CSRF filter to allow Vaadin internal framework requests to be properly processed.

      Parameters:
      enableCsrfConfiguration - whether CSRF configuration should be enabled
      Returns:
      the current configurer instance for method chaining

    • enableLogoutConfiguration

      public VaadinSecurityConfigurer enableLogoutConfiguration(boolean enableLogoutConfiguration)
      Enables or disables automatic logout configuration (enabled by default).

      This configurer will automatically configure logout behavior to work properly with Flow and Hilla.

      Parameters:
      enableLogoutConfiguration - whether logout configuration should be enabled
      Returns:
      the current configurer instance for method chaining

    • enableRequestCacheConfiguration

      public VaadinSecurityConfigurer enableRequestCacheConfiguration(boolean enableRequestCacheConfiguration)
      Enables or disables automatic configuration of the request cache (enabled by default).

      This configurer will automatically configure the request cache to work properly with Vaadin's internal framework requests.

      Parameters:
      enableRequestCacheConfiguration - whether configuration of the request cache should be enabled
      Returns:
      the current configurer instance for method chaining

    • enableExceptionHandlingConfiguration

      public VaadinSecurityConfigurer enableExceptionHandlingConfiguration(boolean enableExceptionHandlingConfiguration)
      Enables or disables automatic configuration of exception handling (enabled by default).

      This configurer will automatically configure exception handling to work properly with Flow and Hilla.

      Parameters:
      enableExceptionHandlingConfiguration - whether configuration of exception handling should be enabled
      Returns:
      the current configurer instance for method chaining

    • enableAuthorizedRequestsConfiguration

      public VaadinSecurityConfigurer enableAuthorizedRequestsConfiguration(boolean enableAuthorizedRequestsConfiguration)
      Enables or disables automatic configuration of authorized requests (enabled by default).

      This configurer will automatically configure authorized requests to permit requests to anonymous Flow and Hilla views, and static assets.

      Parameters:
      enableAuthorizedRequestsConfiguration - whether configuration of authorized requests should be enabled
      Returns:
      the current configurer instance for method chaining
      See Also:

    • enableSessionManagementConfiguration

      public VaadinSecurityConfigurer enableSessionManagementConfiguration(boolean enableSessionManagementConfiguration)
      Enables or disables automatic configuration of session management (enabled by default).

      This configurer will automatically configure a VaadinExpiredSessionStrategy, so that a session expired by Spring Security concurrency control is handled in a way the Vaadin client understands. The strategy is only used by Spring Security when concurrency control is active, i.e. when the application sets a maximum number of sessions.

      The strategy is only configured if the application has session management configured, which @EnableWebSecurity does by default through Spring Security's HttpSecurityConfiguration.

      Note that the configured strategy replaces both a strategy and an expired URL set directly on HttpSecurity, since Spring Security uses the expired URL only when no strategy is set. Use expiredSessionStrategy(SessionInformationExpiredStrategy) to configure a custom strategy, or disable this configuration.

      Parameters:
      enableSessionManagementConfiguration - whether configuration of session management should be enabled
      Returns:
      the current configurer instance for method chaining
      Since:
      25.4

    • expiredSessionStrategy

      public VaadinSecurityConfigurer expiredSessionStrategy(org.springframework.security.web.session.SessionInformationExpiredStrategy expiredSessionStrategy)
      Sets the strategy used when Spring Security concurrency control detects an expired session.

      Defaults to VaadinExpiredSessionStrategy.

      Parameters:
      expiredSessionStrategy - the strategy to use, or null to use the default one
      Returns:
      the current configurer instance for method chaining
      Since:
      25.4
      See Also:

    • anyRequest

      public VaadinSecurityConfigurer anyRequest(Consumer<org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer<org.springframework.security.config.annotation.web.builders.HttpSecurity>.org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizedUrl> anyRequestAuthorizeRule)
      Configures the access rule for any request not matching other configured rules.

      The default rule is to restrict access, which is the equivalent of passing AuthorizeHttpRequestsConfigurer.AuthorizedUrl.denyAll() to this method.

      Parameters:
      anyRequestAuthorizeRule - the access rule for any request not matching other rules, or null to disable automatic configuration
      Returns:
      the current configurer instance for method chaining

    • enableNavigationAccessControl

      public VaadinSecurityConfigurer enableNavigationAccessControl(boolean enableNavigationAccessControl)
      Enables or disables configuration of NavigationAccessControl.

      NavigationAccessControl is enabled by default.

      Parameters:
      enableNavigationAccessControl - a boolean flag indicating whether NavigationAccessControl should be enabled or disabled
      Returns:
      the current configurer instance for method chaining

    • defaultPermitMatcher

      public org.springframework.security.web.util.matcher.RequestMatcher defaultPermitMatcher()
      Creates and returns a composite RequestMatcher for identifying requests that should be permitted without authentication within a Vaadin application.

      This matcher combines multiple specific matchers, including those for framework internal requests, anonymous endpoints, allowed Hilla views, anonymous routes, custom web icons, PWA resources, and default security configurations.

      Returns:
      a RequestMatcher that matches requests to be allowed without authentication

    • init

      public void init(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
      Specified by:
      init in interface org.springframework.security.config.annotation.SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>
      Overrides:
      init in class org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>

    • configure

      public void configure(org.springframework.security.config.annotation.web.builders.HttpSecurity http)
      Specified by:
      configure in interface org.springframework.security.config.annotation.SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>
      Overrides:
      configure in class org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,org.springframework.security.config.annotation.web.builders.HttpSecurity>

    • getDefaultHttpSecurityPermitMatcher

      public static org.springframework.security.web.util.matcher.RequestMatcher getDefaultHttpSecurityPermitMatcher()
      Matcher for framework internal requests. Assumes Vaadin servlet to be mapped on root path (/*).
      Returns:
      default HttpSecurity bypass matcher
      Since:
      25.0

    • getDefaultHttpSecurityPermitMatcher

      public static org.springframework.security.web.util.matcher.RequestMatcher getDefaultHttpSecurityPermitMatcher(String urlMapping)
      Matcher for framework internal requests, with Vaadin servlet mapped on the given path.
      Parameters:
      urlMapping - url mapping for the Vaadin servlet.
      Returns:
      default HttpSecurity bypass matcher
      Since:
      25.0

    • getDefaultWebSecurityIgnoreMatcher

      public static org.springframework.security.web.util.matcher.RequestMatcher getDefaultWebSecurityIgnoreMatcher()
      Matcher for Vaadin static (public) resources. Assumes Vaadin servlet to be mapped on root path (/*).
      Returns:
      default matcher for Vaadin static (public) resources.
      Since:
      25.0

    • getDefaultWebSecurityIgnoreMatcher

      public static org.springframework.security.web.util.matcher.RequestMatcher getDefaultWebSecurityIgnoreMatcher(String urlMapping)
      Matcher for Vaadin static (public) resources, with Vaadin servlet mapped on the given path. Assumes Vaadin servlet to be mapped on root path (/*).
      Parameters:
      urlMapping - the url mapping for the Vaadin servlet
      Returns:
      default matcher for Vaadin static (public) resources.
      Since:
      25.0