> Markdown version of [Properties](https://vaadin.com/docs/next/flow/configuration/properties). Section index: [llms.txt](https://vaadin.com/docs/next/flow/llms.txt)

# Configuration Properties

You can change the behavior of Vaadin applications by setting the configuration properties. Either set them through the system properties, or with the servlet initialization parameters. See the [full list of properties](#properties) for details.

See also the [Spring-specific instructions](https://vaadin.com/docs/next/flow/integrations/spring/configuration.md) for Spring-based applications.

## <a id="system-properties"></a>System Properties

When using Java system properties to set Vaadin application parameters, the `vaadin.` prefix has to be specified before each parameter name. The following shows how to set the `pnpm.enable` system property when executing a Maven goal from the command-line:

```bash
mvn jetty:run -Dvaadin.pnpm.enable=true
```

You can also configure system properties for Maven plugin executions. For instance, the following sets a Vaadin-specific system property when running the Jetty Maven plugin:

```xml
<plugin>
    <groupId>org.eclipse.jetty</groupId>
    <artifactId>jetty-maven-plugin</artifactId>
    <configuration>
        <systemProperties>
            <systemProperty>
                <name>vaadin.pushMode</name>
                <value>disabled</value>
            </systemProperty>
        </systemProperties>
    </configuration>
</plugin>
```

## <a id="servlet-initialization-parameters"></a>Servlet Initialization Parameters

Another option for setting configuration properties is to use servlet initialization parameters. Use the Servlet 3.0 `@WebServlet` annotation. This requires you to configure your servlet — unless you want Vaadin Flow to do it — using default parameter values.

```java
@WebServlet(urlPatterns = "/*", name = "myservlet", asyncSupported = true, loadOnStartup = 1,
    initParams = { @WebInitParam(name = "pnpm.enable", value = "true") })
public class MyServlet extends VaadinServlet {
}
```

Yet another approach is to use the `web.xml` file. Below is an example of one:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app
  id="WebApp_ID" version="3.0"
  xmlns="http://java.sun.com/xml/ns/j2ee"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
      http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">

  <servlet>
    <servlet-name>myservlet</servlet-name>
    <servlet-class>
        com.vaadin.flow.server.VaadinServlet
    </servlet-class>
    <load-on-startup>1</load-on-startup>

    <init-param>
      <param-name>pnpm.enable</param-name>
      <param-value>true</param-value>
    </init-param>
  </servlet>

  <servlet-mapping>
    <servlet-name>myservlet</servlet-name>
    <url-pattern>/*</url-pattern>
  </servlet-mapping>
</web-app>
```

> **Note: System Properties Override Servlet Parameters**
>
> When a system property and a servlet parameter have the same name, the system property is used, while the servlet parameter is ignored.

## <a id="properties"></a>List of Properties

The following list contains the properties that are defined in the `com.vaadin.server.DeploymentConfiguration`, `com.vaadin.flow.server.Constants` and `com.vaadin.flow.server.InitParameters` classes. They’re listed in alphabetical order. If you use Spring Boot, you should add the `vaadin.` prefix to them (e.g., change `brotli` to `vaadin.brotli`).

Each property defines a "mode", which is either **Development**, **Production**, **Runtime**, **Build**, or **Bundle**. Development and production parameters are used in execution of the application in these modes. Runtime parameters change application functionality during execution and don’t depend on development/production modes. Build parameters change build-time functionality. Bundle parameters controls parts of the frontend bundle creation.

- `applicationIdentifier`

  Application identifier that’s generated by default based on the project build settings. The property is used only for the moment by the daily active users license model. It can be configured by developers to differentiate end-users distribution between the same applications running in a cluster — ones that have the same group and artifact IDs.\
  Default: `default-project-id`\
  Mode: Runtime

- `brotli`

  Determines whether pre-compressed [Brotli](https://github.com/google/brotli) files should be used if accepted by the browser. Brotli files are created during a production build. The property is used only in production mode. Set to `false` if you want to serve uncompressed static resources.\
  Default: `true`\
  Mode: Runtime

- `closeIdleSessions`

  Closes the Vaadin session if no UI is active. A UI is considered active if it’s open on the client-side and has any activity — besides heartbeat requests. By default, heartbeat requests keep the Vaadin session open even when there isn’t any user interaction. Set to `true` to close idle sessions. See `heartbeatInterval` below.\
  Default: `false`\
  Mode: Runtime

- `devmode.componentTracker.enabled`

  Enable component tracking in development mode.\
  Default: `true`\
  Mode: Development

- `devmode.devTools.enabled`

  Parameter for enabling development tools. Production mode always evaluates as `false`.\
  Default: `true`\
  Mode: Development

- `devmode.frontendExtraFileExtensions`

  Define additional frontend file extensions to copy from jar files to the application `frontend/generated/jar-resources`. Default extension copied are `.js`, `.js.map`, `.ts`, `.ts.map`, `.tsx`, `.tsx.map`, `.css`, and `.css.map`.\
  Default: `""`\
  Mode: Development

- `devmode.hostsAllowed`

  Defines the hosts allowed to access Vaadin development tools. A comma-separated list of allowed hosts should be provided as the value. The `?` and ``**wildcards can be used (e.g., `192.168.1.`**`,172.17.?.*`). Loopback addresses are always allowed, regardless of the value set here.\
  Default: `null`\
  Mode: Development

- `devmode.liveReload.enabled`

  Enables live reload. When using a server-side [live reload tool](https://vaadin.com/docs/next/flow/configuration/live-reload.md), the browser is refreshed after code is rebuilt on the server. Set to `false` to disable automatic reloading of the browser. This applies only to development mode.\
  Default: `true`\
  Mode: Development

- `devmode.optimizeBundle`

  Optimizes frontend resource bundles. All frontend resources in the classpath are included by default in the generated bundle in development mode. When set to `true`, the frontend build creates an optimized bundle by including only frontend resources that are used from the application entry points. It uses bytecode scanning, which increases application start-up time. Set to `false` to skip the optimization in production mode.\
  Default: `false`\
  Mode: Build

- `devmode.output.pattern.timeout`

  Defines the time to wait for the frontend build tool to output either the success or error string for completion.\
  Default: 60000 ms\
  Mode: Development

- `devmode.remoteAddressHeader`

  The name of the custom HTTP header that contains the client IP address that is checked to allow access to the development mode server. The HTTP header is supposed to contain a single address, and the HTTP request to have a single occurrence of the header. If not specified, remote address are read from the `X-Forwarded-For` header\
  Default:\
  Mode: Development

- `devmode.sessionSerialization.enabled`

  Enables session serialization. When session serialization is enabled, `UI` instances and registered `ElementStreamResource` instances are serialized or deserialized when restarting the development server. When set to `true`, for example, access control information can be preserved during development so that you don’t need to log in for each change. This applies only to development mode.\
  Default: `false`\
  Mode: Development

- `devmode.usageStatistics.enabled`

  Enables Vaadin to collect usage statistics that can guide further development. Statistics are collected based on features that are used in the application. No data is collected in production mode. Some usage statistics are collected through the web browser. See the [client-side collector repository](https://github.com/vaadin/vaadin-usage-statistics) for instructions on how to opt out. This applies only to development mode.\
  Default: `true`\
  Mode: Development

- `devmode.vite.options`

  Define extra options for Vite execution.\
  Default:\
  Mode: Development

- `disable.automatic.servlet.registration`

  Disables automatic servlet registration that’s required by Vaadin applications. You must register Vaadin servlets if set to `true`.\
  Default: `false`\
  Mode: Runtime

- `disable-xsrf-protection`

  Disables cross-site request forgery protection. The protection is enabled by default. You should keep it enabled — except for certain types of testing.\
  Default: `false`\
  Mode: Runtime

- `eagerServerLoad`

  Enables the client-side bootstrap page to include the initial JSON data fragment.\
  Default: `false`\
  Mode: Runtime

- `frameOptions`

  The value of the `X-Frame-Options` HTTP response header (since V25.2) sent with the application page. The header lets the browser protect the application against clickjacking. Common values are `SAMEORIGIN` and `DENY`. Set the parameter to an empty value to disable sending the header, for example for applications that are meant to be embedded in a frame. The header is only set if the response doesn’t already contain an `X-Frame-Options` header set by other means, such as Spring Security or a servlet filter.\
  Default: `SAMEORIGIN`\
  Mode: Runtime

- `frontend.hotdeploy`

  Enables development using the frontend development server instead of an application bundle. This applies only to development mode. Hilla always forces frontend `hotdeploy` to true. This is a runtime property read by the application. For Gradle projects, the Gradle plugin requires separate configuration via the `frontendHotdeploy` option in the `vaadin {}` block (see [Vaadin Plugin Configuration](https://vaadin.com/docs/next/flow/configuration/gradle.md#build-file.vaadin-options)).\
  Default: `false`\
  Mode: Development

- `frontend.hotdeploy.dependencies`

  A comma-separated list of module directories to watch for frontend file changes when detecting hot-deployable resources. Entries need to point to directories relative to the module that starts the Vaadin application, and can point to the module itself as well, in case it provides frontend files as resources. The value could be for example "./,./component-module-1,./component-module-2". Flow will watch for changes in both `src/main/resources/META-INF/frontend` and the deprecated `src/main/resources/META-INF/resources/frontend` directories under the given three directory entries. Do note that if this parameter is not defined, Vaadin watches for changes under `src/main/resources/META-INF/` in the module that starts the Vaadin application, but when you provide a custom value for the parameter you need to add "./" to the list of directories to watch for the same effect.\
  Default: `""`\
  Mode: Development

- `heartbeatInterval`

  Sets the heartbeat interval time. UIs that are open on the client-side send a regular heartbeat to the server indicating that they’re still active even without ongoing user interaction. When the server doesn’t receive a valid heartbeat from a given UI within a certain amount of time, it removes that UI from the session. The interval value is expressed in `seconds`. See also `closeIdleSessions`.\
  Default: 300 seconds (i.e., 5 minutes)\
  Mode: Runtime

- `i18n.provider`

  Sets the fully-qualified name for the internationalization provider class. To translate strings for localization, the application should implement the `I18NProvider` interface and define the class name in the `i18n.provider` property. See the [Localization documentation](https://vaadin.com/docs/next/flow/i18n.md) for details.\
  Default: `null`\
  Mode: Runtime

- `maxMessageSuspendTimeout`

  Sets the maximum time in `milliseconds` that the client waits for predecessors of an out-of-sequence message, before considering them missing and requesting a full state resynchronization from the server. For example, when a server sends adjacent `XmlHttpRequest` responses and pushes messages over a low-bandwidth connection, the client may receive the messages out of sequence. Increase this value if your application experiences excessive resynchronization requests. However, be aware that it degrades the UX with flickering and loss of client-side-only states, such as scroll position.\
  Default: 5000 ms (i.e., 5 seconds)\
  Mode: Runtime

- `maxRequestBodySize`

  Sets the maximum size of a client-to-server UIDL/RPC or push request body that Flow reads before rejecting the request with an HTTP `413` (Request Entity Too Large) response. The value is the number of characters — individual units of text read from the request body. For the ASCII JSON that Flow sends, one character corresponds to roughly one byte, so `1024` allows a request body of about 1 KB and the default of `10485760` allows about 10 MB. It doesn’t affect file uploads, which are streamed in chunks and have their own separate size limits. Set to `-1` to disable the limit. Avoid setting a value too low: protocol overhead and larger component-state changes can cause legitimate interactions to exceed a small limit.\
  Default: 10485760 (i.e., about 10 MB)\
  Mode: Runtime

- `menu.access.control`

  Define a menu access control implementation by giving a Fully Qualified Name to the control class.\
  Default:\
  Mode: Runtime

- `node.download.root`

  Base URL to download Node.js during build.\
  Default: `https://nodejs.org/dist/`\
  Mode: Build

- `node.version`

  Node.js version to get if one doesn’t exist.\
  Default: See `FrontendTools.DEFAULT_NODE_VERSION`\
  Mode: Build

- `node.folder`

  The folder containing the Node.js executable to use. When specified, Node.js is exclusively used from this folder. If the binary isn’t found there, the build fails with no fallback. See [Custom Node.js Folder](https://vaadin.com/docs/next/flow/configuration/development-mode/node-js.md#node-folder) for more information.\
  Default: `null`\
  Mode: Build

- `npm.excludeWebComponents`

  Excludes all Vaadin professional and core components from `package.json`. Lumo theme is not excluded. Excluded packages aren’t installed by npm, which makes development bundles smaller. This property alone doesn’t remove any Maven and Gradle dependencies. Supported also as a Vaadin Plugin property, `npmExcludeWebComponents`. See [Optimize Bundle](https://vaadin.com/docs/next/flow/configuration/development-mode.md#exclude-vaadin-components) for more information.\
  Default: `false`\
  Mode: Build

- `npm.excludePostinstallPackages`

  Defines npm packages to exclude from running `postinstall` scripts. Entries are removed from the built-in default postinstall list (e.g., `esbuild`), as well as from any additional packages added via `npm.postinstallPackages`.\
  Default:\
  Mode: Build

- `npm.minimumFrontendPackageAgeDays`

  Defines the minimum age, in days, that a frontend (npm) package version must have before npm, pnpm, or bun is allowed to install it. (since V25.2) Package versions published more recently than the configured number of days aren’t installed. This protects against supply-chain attacks where a compromised package version is briefly available on the registry. A value set here overrides the minimum release age the package manager is configured with; where nothing is set here, that configuration applies, and package versions have to be at least one day old where it’s unset as well. Set to `0` to add no restriction of Vaadin’s own. Requires pnpm 10.16.0 or later, or bun 1.3.0 or later, when those package managers are used.\
  Default:\
  Mode: Build

- `npm.postinstallPackages`

  Define post-install scripts that need to be executed after npm install completes.\
  Default:\
  Mode: Build

- `pageTitle.generator`

  Sets the fully qualified name of an application-wide default `PageTitleGenerator` implementation, used to resolve page titles for routes that don’t declare their own `@DynamicPageTitle`. See [Generating Page Titles](https://vaadin.com/docs/next/flow/routing/page-titles.md#generating-page-titles) for details.\
  Default: `null`\
  Mode: Runtime

- `pnpm.enable`

  Enables `pnpm`, instead of `npm`, to resolve and download frontend dependencies. It’s set by default to `false` since `npm` is used typically. Set it to `true` to enable `pnpm`. See [Switching Between npm, pnpm and bun](https://vaadin.com/docs/next/flow/configuration/development-mode/npm-pnpm-bun.md) for more information.\
  Default: `false`\
  Mode: Build

- `pnpm.global`

  Force use of system installed pnpm instead of a Flow managed one.\
  Default: `false`\
  Mode: Build

- `bun.enable`

  Enables `bun`, instead of `npm`, to resolve and download frontend dependencies. It’s set by default to `false` since `npm` is used typically. Set to `true` to enable `bun`. See [Switching between npm, pnpm and bun](https://vaadin.com/docs/next/flow/configuration/development-mode/npm-pnpm-bun.md) for more information.\
  Default: `false`\
  Mode: Build

- `build.folder`

  Build directory for application\
  Default: `${project.build.directory}`\
  Mode: Build

- `pushLongPollingSuspendTimeout`

  Sets the timeout in `milliseconds` for network requests when using long polling transport. If you have long polling enabled with a proxy that has a timeout, set `pushLongPollingSuspendTimeout` to less time than the proxy timeout for clients to reconnect.\
  Default: `-1` (i.e., no timeout)\
  Mode: Runtime

- `pushMode`

  Enables server push. The permitted values are `disabled`, `manual`, and `automatic`. See [Server Push](https://vaadin.com/docs/next/flow/advanced/server-push.md) for more information.\
  Default: `disabled`\
  Mode: Runtime

- `pushServletMapping`

  Specifies the servlet mapping used for bidirectional (i.e., "push") client-server communication. Some Java application servers require special context. For example, you can specify websockets with this.\
  Default: `""`\
  Mode: Runtime

- `react.enable`

  Whether to use React Router, add React core dependencies, React integration helpers and Vaadin’s provided React components (i.e., `@vaadin/react-components`). Setting this to `false` (deprecated since V25.0) falls back to the deprecated Vaadin Router, excludes all React dependencies and adds Lit dependencies; that option is removed in Vaadin 26. Vaadin plugin configuration for the `reactEnable` property needs to be set to match the configuration property value. See [Vaadin Router Deprecation](https://vaadin.com/docs/next/upgrading.md#vaadin-router-removal) for more information.\
  Default: `true`\
  Mode: Runtime

- `requestTiming`

  Includes basic timing information in responses that can be used for performance testing.\
  Default: `true` for development mode; `false` for production mode\
  Mode: Runtime

- `require.home.node`

  Skip global Node.js lookup and use only Vaadin-managed installations in `~/.vaadin/`. When set to `true`, the global `PATH` is not checked and Node.js is resolved from version-specific directories under `~/.vaadin/` (e.g., `~/.vaadin/node-v24.14.0/`). If a suitable version isn’t found, it’s downloaded and installed automatically.\
  Default: `false`\
  Mode: Build

- `safeUrlSchemes`

  Comma-separated list of URL schemes that are considered safe (since V25.2) in URLs passed to `Anchor.setHref()`, `IFrame.setSrc()`, and `Page.open()`. URLs whose scheme isn’t in the list are rejected with an `IllegalArgumentException`. Relative URLs are always accepted. An entry of `*` marks every scheme as safe, disabling the validation. URLs with unsafe schemes can still be set through the dedicated unsafe setters, such as `Anchor.setUnsafeHref()`. In Vaadin 25.2.1 this parameter was named `com.vaadin.safeUrlSchemes`; that name is deprecated but still recognized for backwards compatibility.\
  Default: `http,https,mailto,tel,ftp`\
  Mode: Runtime

- `syncIdCheck`

  Enables synchronized ID checking. The synchronized ID is used to handle situations in which the client sends a message to a connector that has been removed from the server. It’s set to `true`, by default. You should only disable it if your application doesn’t need to stay synchronized, and suffers from a bad network connection.\
  Default: `true`\
  Mode: Runtime

- `webComponentDisconnect`

  Sets the number of `seconds` that a Vaadin Flow application embedded as a Web Component waits for a reconnect before removing the server-side component from memory.\
  Default: 300 seconds (i.e., 5 minutes)\
  Mode: Runtime

- `sessionLockCheckStrategy`

  When production mode is enabled, the Vaadin session lock check is done according to this setting. By default, the check is performed only if assertions are also enabled. This is to avoid the small performance impact of checking continuously the lock status. Alternative values are `log` to log a warning, or `throw` to fail with an `IllegalStateException`. The `log` option also logs a full stack trace, enabling you to determine any problematic calls to Vaadin UI components from background threads. This is since Vaadin Flow version 24.4.\
  Default: `assert`\
  Mode: Runtime

## <a id="vaadin-plugin-properties"></a>Vaadin Plugin Properties

The following list contains the properties that are used only by the Vaadin Maven and Gradle Plugin, and are not applicable for deployment configuration:

- `ciBuild`

  Determines whether `npm ci` is run, instead of `npm i`, for production frontend builds. If you use `pnpm` or `bun`, the install command runs with the `--frozen-lockfile` parameter. The build fails if the `package.json` and the lockfile have mismatching versions.\
  Default: `false`\
  Mode: Build

- `forceProductionBuild`

  Forces Vaadin Flow to create a new production bundle, even if there is already a usable pre-compiled bundle. This is required usually when creating an optimized production bundle, and to load component sources to the browser on demand — such as when opening a route where these components are used.\
  Default: `false`\
  Mode: Build

- `optimizeBundle`

  Optimizes frontend resource bundles. All frontend resources in the classpath are included by default in the generated bundle in development mode. When set to `true`, the frontend build creates an optimized bundle by including only frontend resources that are used from the application entry points. It uses bytecode scanning, which increases application start-up time. Set to `false` to skip the optimization in production mode.\
  Default: `true`\
  Mode: Bundle

- `frontendDirectory`

  Directory containing the project’s frontend files. Can be given as relative or absolute.\
  Default: `./src/main/frontend`\
  Mode: Build

- `generatedTsFolder`

  Directory where any generated frontend files should be placed. By default, the directory is `generated` and positioned below `frontendDirectory`.\
  Default: `null`\
  Mode: Build

- `frontendIgnoreVersionChecks`

  Makes Flow skip node and npm/pnpm/bun version checks during bundle build and development server startup. Note that disabling frontend tools version checking can cause failing builds and other issues that are difficult to debug.\
  Default:\
  Mode: Development, Bundle

- `javaSourceFolder`

  Source folder used for component scanning during development mode.\
  Default: `${project.basedir}/src/main/java`\
  Mode: Development

- `javaResourceFolder`

  Resources source folder used for component scanning during development mode.\
  Default: `${project.basedir}/src/main/java`\
  Mode: Development

- `npmFolder`

  Directory containing `package.json`.\
  Default: `${project.basedir}`\
  Mode: Build

- `openApiJsonFile`

  Defines where the OpenAPI JSON file is generated if required for exported services.\
  Default: `${project.build.directory}/generated-resources/openapi.json`\
  Mode: Build

- `projectBasedir`

  Directory containing `pom.xml` or `build.gradle`.\
  Default: `${project.basedir}`\
  Mode: Build

- `resourceOutputDirectory`

  Directory to place resources that are not served from the application.\
  Default: `${project.build.outputDirectory}/META-INF/VAADIN/`\
  Mode: Build

- `webpackOutputDirectory`

  Directory to generate served resources as `index.js` and other generated files.\
  Default: `${project.build.outputDirectory}/META-INF/VAADIN/webapp/`\
  Mode: Build

- `skipDevBundleRebuild`

  Prevents a frontend development bundle from being re-built, even if Vaadin Flow decides to use an existing compiled development bundle. This is mainly needed when the re-bundling checker in Vaadin Flow has problems leading to false re-bundling, and one needs a workaround while it’s being resolved.\
  Default: `false`\
  Mode: Bundle

- `cleanFrontendFiles`

  Clears the generated frontend files after building a project for production. It keeps the generated files if they existed before the build, or if this parameter is set to `false`. When building a bundle in development mode, the generated files are removed unless they existed before the build.\
  Default: `true`\
  Mode: Bundle

`27BF72FB-1E23-42B0-B540-A602F9AD4571`