Security
Vaadin Flow is a server-side framework, where all the application state, business model, and UI logic stay on the server. A Flow application never exposes its internals to the browser, where vulnerabilities could be abused by an attacker. This makes the development model inherently secure. However, best practices should be followed and common vulnerabilities should be avoided to ensure security.
This section is the reference for the security features of Flow. For task-oriented guides that build on them, see Building Apps > Security. The guides cover the following topics in more depth:
-
Logging users in and out with a login view, including where users land after logging in, and making the logout success URL reachable without authentication. See Add Login and Add Logout.
-
Restricting what users can do within a view, and why only server-side restrictions are a security measure. See Controlling Access within Views.
-
Showing a clear message when a service denies access to the current user. See Access Denied by a Service.
-
Logging users in through an OpenID Connect identity provider, such as Keycloak, mapping the provider’s roles, and ending the session at the provider on logout. See Connect an Identity Provider. For the configuration reference, see Vaadin Security Configurer and OAuth2 Authentication.
-
Protecting application services with Spring method security, including rules about individual records. See Protect Services.
-
Testing the security rules. See Test View Access Control and Testing Method Security.
For what to plan for when the data of several tenants has to stay apart, see Tenant Isolation.
- Enabling Security
- Enable and configure security in a Vaadin Flow application using built-in security helpers with Spring Boot.
- Vaadin Security Configurer
- How to use VaadinSecurityConfigurer to configure security in a Vaadin Flow application using built-in security helpers with Spring Boot.
- Advanced Security Topics
- Documentation of advanced security topics.