Skip to content

[docs] Update docs for vaadin/flow#25625: feat(vaadin-spring): add Vaadin-aware expired session handling #6053

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
vaadin-bot wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

[docs] Update docs for vaadin/flow#25625: feat(vaadin-spring): add Vaadin-aware expired session handling #6053

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 57 additions & 0 deletions articles/flow/security/vaadin-security-configurer.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@
* `RequestCacheConfigurer` — To set a request cache designed for Vaadin applications (can be disabled)
* `ExceptionHandlingConfigurer` — To configure proper exception handling for Vaadin applications (can be disabled)
* `AuthorizeHttpRequestsConfigurer` — To permit internal framework requests and other public endpoints (can be disabled)
* `SessionManagementConfigurer` — To handle expired sessions in a way the Vaadin client understands (can be disabled)

==== Shared Objects

Expand Down Expand Up @@ -158,6 +159,22 @@

Enables or disables automatic configuration of authorized requests (enabled by default). This configurer will automatically configure authorized requests to permit requests to anonymous Flow and Hilla views, and static assets.

[source,java]
----
public VaadinSecurityConfigurer enableSessionManagementConfiguration(boolean enableSessionManagementConfiguration)
----

Enables or disables automatic configuration of session management (enabled by default). This configurer automatically configures a [classname]`VaadinExpiredSessionStrategy`, so that a session expired by Spring Security concurrency control is handled in a way the Vaadin client understands. The strategy is only used by Spring Security when concurrency control is active, that is, when the application sets a maximum number of sessions. It's only configured if the application has session management configured, which `@EnableWebSecurity` does by default.

Note that the configured strategy replaces both a strategy and an expired URL set directly on `HttpSecurity`, since Spring Security uses the expired URL only when no strategy is set. Use [methodname]`expiredSessionStrategy()` to configure a custom strategy, or disable this configuration.

Check warning on line 169 in articles/flow/security/vaadin-security-configurer.adoc

View workflow job for this annotation

GitHub Actions / lint 

[vale] reported by reviewdog 🐶
[Vaadin.NoteThat] Avoid using 'note that'.

Raw Output:
{"message":"[Vaadin.NoteThat] Avoid using 'note that'.","location":{"path":"articles/flow/security/vaadin-security-configurer.adoc","range":{"start":{"line":169,"column":1},"end":{"line":169,"column":10}}},"severity":"WARNING","code":{"value":"Vaadin.NoteThat"}}

[source,java]
----
public VaadinSecurityConfigurer expiredSessionStrategy(SessionInformationExpiredStrategy expiredSessionStrategy)
----

Sets the strategy used when Spring Security concurrency control detects an expired session. Defaults to [classname]`VaadinExpiredSessionStrategy`. Pass `null` to fall back to the default strategy.

[source,java]
----
public VaadinSecurityConfigurer enableNavigationAccessControl(boolean enableNavigationAccessControl)
Expand Down Expand Up @@ -351,6 +368,39 @@
}
----

===== Handling Expired Sessions

When an application limits each user to one active session with Spring Security's concurrency control, logging in on a second device must invalidate the session on the first device. Configure the maximum number of sessions on `sessionManagement()`, and `VaadinSecurityConfigurer` automatically makes sure the browser with the invalidated session shows Vaadin's session-expired dialog and reloads, instead of getting a plain-text page it can't use:

[source,java]
----
@Configuration
@EnableWebSecurity
public class SecurityConfig {

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
return http.with(VaadinSecurityConfigurer.vaadin(),
configurer -> configurer.loginView(LoginView.class))
.sessionManagement(sessionManagement -> sessionManagement
.sessionConcurrency(concurrency -> concurrency
.maximumSessions(1)))
.build();
}
}
----

Applications that don't configure a maximum number of sessions aren't affected, because Spring Security only checks for expired sessions when concurrency control is active.

To handle the expiration differently, for example to send the user to a custom page, pass a custom strategy with [methodname]`expiredSessionStrategy()`:

[source,java]
----
http.with(VaadinSecurityConfigurer.vaadin(), configurer -> configurer
.expiredSessionStrategy(event -> event.getResponse()
.sendRedirect("/session-expired")));
----

===== Disabling Features

The `VaadinSecurityConfigurer` provides some security features enabled by
Expand All @@ -375,6 +425,13 @@
navigation security, and you will need to implement your own access control
logic for view navigation.

- **Session Management Configuration** (`enableSessionManagementConfiguration(false)`):
By default, the configurer installs [classname]`VaadinExpiredSessionStrategy` so
that a session expired by Spring Security concurrency control is handled in a
way the Vaadin client understands.
Disabling this restores Spring Security's default expired-session response,
which the Vaadin client can't process.

====== When To Disable

You should only disable these features if:
Expand Down
Loading