Package com.vaadin.server

Interface DeploymentConfiguration

    • Method Detail

      • isProductionMode

        boolean isProductionMode()
        Returns whether Vaadin is in production mode.
        Returns:
        true if in production mode, false otherwise.

      • isXsrfProtectionEnabled

        boolean isXsrfProtectionEnabled()
        Returns whether cross-site request forgery protection is enabled.
        Returns:
        true if XSRF protection is enabled, false otherwise.

      • isSyncIdCheckEnabled

        boolean isSyncIdCheckEnabled()
        Returns whether sync id checking is enabled. The sync id is used to gracefully handle situations when the client sends a message to a connector that has recently been removed on the server.
        Returns:
        true if sync id checking is enabled; false otherwise
        Since:
        7.3

      • getResourceCacheTime

        int getResourceCacheTime()
        Returns the time resources can be cached in the browsers, in seconds.
        Returns:
        The resource cache time.

      • getHeartbeatInterval

        int getHeartbeatInterval()
        Returns the number of seconds between heartbeat requests of a UI, or a non-positive number if heartbeat is disabled.
        Returns:
        The time between heartbeats.

      • getMaxRequestBodySize

        default long getMaxRequestBodySize()
        Returns the maximum size, in characters, that the framework reads from a client-to-server UIDL/RPC or push request body before rejecting the request with HTTP 413 (Request Entity Too Large).

        The limit does not apply to file uploads, which have their own separate size limits.

        Returns:
        the maximum request body size in characters, or a negative number if the limit is disabled
        Since:

      • isSendUrlsAsParameters

        boolean isSendUrlsAsParameters()
        Returns whether the sending of URL's as GET and POST parameters in requests with content-type application/x-www-form-urlencoded is enabled or not.
        Returns:
        false if set to false or true otherwise

      • isCloseIdleSessions

        boolean isCloseIdleSessions()
        Returns whether a session should be closed when all its open UIs have been idle for longer than its configured maximum inactivity time.

        A UI is idle if it is open on the client side but has no activity other than heartbeat requests. If isCloseIdleSessions() == false, heartbeat requests cause the session to stay open for as long as there are open UIs on the client side. If it is true, the session is eventually closed if the open UIs do not have any user interaction.

        Returns:
        True if UIs and sessions receiving only heartbeat requests are eventually closed; false if heartbeat requests extend UI and session lifetime indefinitely.
        Since:
        7.0.0
        See Also:
        WrappedSession.getMaxInactiveInterval()

      • getPushMode

        PushMode getPushMode()
        Returns the mode of bidirectional ("push") client-server communication that should be used.
        Returns:
        The push mode in use.

      • getInitParameters

        Properties getInitParameters()
        Gets the properties configured for the deployment, e.g. as init parameters to the servlet or portlet.
        Returns:
        properties for the application.

      • getApplicationOrSystemProperty

        String getApplicationOrSystemProperty​(String propertyName,
                                      String defaultValue)
        Gets a configured property. The properties are typically read from e.g. web.xml or from system properties of the JVM.
        Parameters:
        propertyName - The simple of the property, in some contexts, lookup might be performed using variations of the provided name.
        defaultValue - the default value that should be used if no value has been defined
        Returns:
        the property value, or the passed default value if no property value is found

      • getUIClassName

        String getUIClassName()
        Gets UI class configuration option value.
        Returns:
        UI class name
        Since:
        7.4

      • getUIProviderClassName

        String getUIProviderClassName()
        Gets UI provider class configuration option value.
        Returns:
        UI class name
        Since:
        7.4

      • getUIProviderPriority

        default int getUIProviderPriority()
        Get the priority of the designated/default UI provider. Higher values are served first. The default value of 0 retains old behavior.
        Returns:
        UI provider priority (defaults to 0)
        Since:
        8.21

      • getWidgetset

        String getWidgetset​(String defaultValue)
        Gets Widgetset configuration option value. defaultValue is returned if widgetset parameter is not configured.
        Returns:
        UI class name
        Since:
        7.4

      • getResourcesPath

        String getResourcesPath()
        Gets resources path configuration option value.
        Since:
        7.4

      • getClassLoaderName

        String getClassLoaderName()
        Gets class loader configuration option value.
        Since:
        7.4

      • getUrlSafeSchemes

        default Set<String> getUrlSafeSchemes()
        Returns the set of URL schemes considered safe in URLs set on components using ExternalResource (such as Image, Link, and FileDownloader) as well as methods such as Page.open(String, String) and Page.setLocation(String).

        Concrete implementations read this from the Constants.URL_SAFE_SCHEMES property; the default returns a singleton set of Constants.URL_SAFE_SCHEMES_WILDCARD, which bypasses the validation and allows all URLs.

        Note: the default and how it's applied changes in modern Vaadin versions. As of July 2026, the Flow versions that support this feature only apply the validation to Anchor, IFrame, Page#open, and Page#setLocation, and bypass e.g. Image and download handling. Also, starting from Vaadin 25.2, the default safe schemes are http, https, mailto, tel and ftp). Script-capable schemes such as javascript and data are intentionally excluded from the Vaadin 25.2 safe URL schemes. Because of technical differences in how Flow and Vaadin 8 handle URLs it is not possible to target the exact same classes here. The wildcard default in versions before Vaadin 25.2 was chosen for backwards compatibility.

        Returns:
        the set of safe URL schemes, never null
        Since: