search

vaadin / flow-crm-tutorial

Demo app for the Java Web App tutorial series
The Unlicense
172 stars 184 forks source link

Logout doesn't work as it should be #172

Closed madukan closed 10 months ago

madukan commented 11 months ago

ie: You can logout from the view, it seem to take you to the link that say login with Keycloak. However, if you directly hit the URL of the dashboard, for instance, http:///dashboard, the user doesn't really need to login again. This is a serious security flow.

madukan commented 11 months ago

I can see in the v24 logout works fine also. Let me test further. So far, I logged out, and then tried to access dashboard, which as expected prompted me back to the login, which is good. Therefore now no issue, in v24.

Mikaelsu commented 11 months ago

Hey! I cannot reproduce the issue. Which branch (which Vaadin version) were you testing it on?

mshabarov commented 11 months ago

@madukan thanks for the issue! Is there something extra on top of CRM tutorial codes that you use and see the issue? Or is it a purely CRM app with no extra codes?

madukan commented 11 months ago

Now that's a good question -- That reminds me I was integrating with Keycloak for the first version, I reverted all that and found the issue, the issue first happen. Let me try to dig a bit more on that. Once it worked I cleaned up all the non-working code off which is going to be a bit tricky trying to pull back from the bin now.

mshabarov commented 10 months ago

I couldn't reproduce this with Vaadin 24.1.8, neither with 23.3.22. The app always redirects me to the login view even if I hit the URL directly.

mshabarov commented 10 months ago

Closed because of no reply from author. Please comment in this ticket or create a new one if this issue is still valid for you.