Open egloffmark opened 1 year ago
@egloffmark thank you for making an issue and asking! Do you have a project example? We are interested in point 2 and 3:
Configure the Spring Security by using VaadinWebSecurity
Register an Own Login View
(how you configure these).
I simple using the standard generated from Vaadin Application / Project initializer at https://start.vaadin.com. There you can setup a flow application with authentication. See below the generated Security configuration.
The problem is not the SecurityConfiguration it is more that the methods on VaadinWebSecurity
class for setLoginView
for Flow and Hilla have different implementations regarding the CSRF. Personally I don't understand why you turn CSRF by default off for the Flow SetLoginView
implementation
@EnableWebSecurity
@Configuration
public class SecurityConfiguration extends VaadinWebSecurity {
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeHttpRequests().requestMatchers(new AntPathRequestMatcher("/images/*.png")).permitAll();
// Icons from the line-awesome addon
http.authorizeHttpRequests().requestMatchers(new AntPathRequestMatcher("/line-awesome/**/*.svg")).permitAll();
super.configure(http);
setLoginView(http, LoginView.class);
}
}
Flow has its own CSRF mechanism for its internal request, so Flow views are protected in this way instead of using Spring. On the other hand, the login web component can also be used without Flow, so it offers a way to handle CSRF tokens that may be handled by the server.
Description of the bug
While I am creating an own "Login" form with Vaadin flow I recognized that the "_csrf" token get not validated for Webflow Login Page.
I looked at the class
VaadinWebSecurity
and debugged its configuration art runtime it seems that it adds a request filter which excludes the login request from CSRF prtotection. Hence, the csrf protection seems to be disabled, but csrf tokens get generated and added into the pages.I am wondering why the documentation mention this explicitly for the login component, See section "Technical" at the Login component documention. Also in the other method for Hilla
setLoginView(hillaLoginViewPath)
thelogin
path get not excludedI like to understand if I miss or oversee here something?
I also added a break point on the
org.springframework.security.web.server.csrf.CsrfWebFilter
but the filter get not called in the Weblof Variant but for the Hilla Variant.So I am here now a bit confused. Can you please clarify why you disable it at the LoginView configuration for Webflow?
The only explanation I have that you may use another Spring Security Filter for validating your csrf but I could not find it.
logged SecurityFilterChain:
Expected behavior
CSRF protection for login and other Forms should be activated and it should be transparent for which requests and where the validation is happening
Minimal reproducible example
Versions