URL Parameters in Vaadin LoginOverlay

user_16686763 0
Viewed 104

I have created a Vaadin 21 project with the Vaadin App Starter. The application uses authentication, so the user first has to login on a LoginView:

@PageTitle("Login")
@Route(value = "login")
public class LoginView extends LoginOverlay implements BeforeEnterListener {
    public LoginView() {
        setAction("login");

        LoginI18n i18n = LoginI18n.createDefault();
        i18n.setHeader(new LoginI18n.Header());
        i18n.getHeader().setTitle("My App");
        i18n.getHeader().setDescription("Login using user/user or admin/admin");
        i18n.setAdditionalInformation(null);
        setI18n(i18n);

        setForgotPasswordButtonVisible(false);
        setOpened(true);
    }

    @Override
    public void beforeEnter(BeforeEnterEvent beforeEnterEvent) {
        Map<String,List<String>> parametersMap = beforeEnterEvent.getLocation().getQueryParameters().getParameters();

        if (parametersMap.contains("myid")) {
            // Do something
        }
    }
}

I want to transmit an id in the URL parameters to customize the LoginView, so I added the beforeEnter method to retrieve the URL parameter. But if I open my app in the browser with the URL http://localhost:8080/login?myid=5, the beforeEnter method is called but there is no URL parameter in the parametersMap, it is empty. How it is possible to transmit a URL parameter in a LoginOverlay View?

vaadin
1 Answers

If you add

logging.level.org.springframework.security=DEBUG

to your src/main/resources/application.properties you will see that Spring Security is the one that prevents your URL parameters from reaching the login view:

2021-09-14 14:01:21.194 DEBUG 24566 --- [io-23342-exec-1] o.s.s.w.a.i.FilterSecurityInterceptor    : Failed to authorize filter invocation [GET /login?myid=5] with attributes [authenticated]
2021-09-14 14:01:21.195 DEBUG 24566 --- [io-23342-exec-1] o.s.s.web.DefaultRedirectStrategy        : Redirecting to http://localhost:23342/login

You can allow this by changing your Spring Security configuration method to e.g.

    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().regexMatchers("/login\\?myid=.*").permitAll();
        super.configure(http);
        setLoginView(http, LoginView.class, LOGOUT_URL);
    }

Now you also need to fix a small problem in your code, which is that you must implement BeforeEnterObserver instead of BeforeEnterListener in your view class for beforeEnter to be called.

user_33367330
Related