security

Configure Spring Security integration for Vaadin 25 applications.

11|3|Updated Feb 26, 2026
One-click install
npx skills add https://github.com/vaadin/claude-plugin --skill security-vaadin
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security
Source: https://github.com/vaadin/claude-plugin/tree/main/skills/security
Command: npx skills add https://github.com/vaadin/claude-plugin --skill security-vaadin

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Protect Vaadin 25 applications from unauthorized access by providing a ready-to-use Spring Security integration, annotations, and logout flows.

Core Features & Use Cases

  • View-level security using Vaadin and Jakarta annotations (@AnonymousAllowed, @PermitAll, @RolesAllowed, @DenyAll)
  • Configurable login views and login forms using Vaadin's LoginForm
  • OAuth2/OpenID Connect integration with providers like Google, Keycloak, and GitHub
  • Secure logout and session management via AuthenticationContext or SecurityContextLogoutHandler
  • Guidance for both development and production setups, including common pitfalls

Quick Start

Create a SecurityConfig that wires VaadinSecurityConfigurer.vaadin() and registers a LoginView with @Route("login", autoLayout = false) to enable authentication and secure access control.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Spring Security authentication in a Vaadin 25 application?

Configure Spring Security authentication in Vaadin 25 by creating a SecurityConfig class that wires VaadinSecurityConfigurer.vaadin() and registers a LoginView with @Route("login", autoLayout = false) to enable secure access control.

Can I use OAuth2 providers like Google or GitHub for login in Vaadin?

Yes, Vaadin 25 applications support OAuth2 and OpenID Connect integration with providers like Google, Keycloak, and GitHub by adding optional OAuth2 client dependencies to your Spring Security configuration.

What annotations are available for view-level access control in Vaadin?

View-level access control in Vaadin is managed using Jakarta and Vaadin annotations including @AnonymousAllowed, @PermitAll, @RolesAllowed, and @DenyAll to define authorization rules on specific views.

How do I handle secure logout and session management in Vaadin Flow?

Handle secure logout and session management in Vaadin Flow using AuthenticationContext or SecurityContextLogoutHandler to properly invalidate user sessions and clear security contexts.

What is needed to set up a login form in a Vaadin application with Spring Security?

Setting up a login form requires using Vaadin's LoginForm component within a configured login view and wiring it through VaadinSecurityConfigurer to integrate with Spring Security authentication flows.

Does Vaadin 25 Security support production setups and common configuration pitfalls?

Yes, Vaadin 25 Security provides guidance for both development and production setups, including configurations for common pitfalls when integrating Spring Security with Vaadin Flow applications.