Skip to content

docs: document security annotations required for custom error views#5381

Open
Artur- wants to merge 1 commit intomainfrom
docs/spring-security-not-found
Open

docs: document security annotations required for custom error views#5381
Artur- wants to merge 1 commit intomainfrom
docs/spring-security-not-found

Conversation

@Artur-
Copy link
Copy Markdown
Member

@Artur- Artur- commented Mar 24, 2026

Custom error handler views like RouteNotFoundError subclasses need security annotations (e.g., @AnonymousAllowed) when using VaadinSecurityConfigurer, which denies all unannotated views by default. Without this, users see a generic error page instead of their custom not-found page.

Adds cross-references between the routing exceptions, protect views, security configurer, and enabling security pages so users can discover this requirement from any entry point.

Fixes #5378

Custom error handler views like RouteNotFoundError subclasses need
security annotations (e.g., @AnonymousAllowed) when using
VaadinSecurityConfigurer, which denies all unannotated views by default.
Without this, users see a generic error page instead of their custom
not-found page.

Adds cross-references between the routing exceptions, protect views,
security configurer, and enabling security pages so users can discover
this requirement from any entry point.

Fixes #5378
@Artur- Artur- requested a review from mcollovati March 24, 2026 17:46
@github-actions
Copy link
Copy Markdown

Preview Deployment

This PR has been deployed for preview.

URL: https://docs-preview-pr-5381.fly.dev

Built from 04a3d31

@mcollovati
Copy link
Copy Markdown
Contributor

Adding the security annotation is not enough to make the error view work. By default, both Spring Security and Vaadin have a deny-all policy for all request paths that are not Vaadin routes or are explicitly configured with a request matcher.
This means that for a non-existing page, Spring Security blocks access before Vaadin servlet is completely reached.
To make the custom not found page, in addition to the security annotations, the anyRequest matcher should be relaxed by using VaadinSecurityConfigurer.anyRequest(..) (or passing null and handle it directly with Spring Security).

@peholmst peholmst added the target/v25.1 Automatically cherry-pick to the v25.1 branch label Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

target/v25.1 Automatically cherry-pick to the v25.1 branch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve Spring Security, VaadinSecurityConfigurer and NotFoundException documentation for Vaadin 25

3 participants