Vaadin-on-Kotlin Security Demo for Vaadin
Demonstrates a secured Vaadin-on-Kotlin-based application. Uses Vaadin Simple Security library. Requires Java 17+.
The project online demo.
Preparing Environment
Please see the Vaadin Boot documentation on how you run, develop and package this Vaadin-Boot-based app.
About the application
The application uses the username+password authorization, with users stored in an in-memory H2 SQL database (the User class). There are no views that could be accessed publicly - the user must log in first, in order to see any part of the app.
There are two users pre-created by the Bootstrap class:
- The 'user' user with the password of 'user' and the role of
ROLE_USER - The 'admin' user with the password of 'admin' and two roles:
ROLE_ADMINandROLE_USER
The AppServiceInitListener configures
Vaadin to check authorization and redirects to the Login route if there's no user logged in.
The username and password are compared against the database. The User class takes advantage
of the HasPassword
mixin which makes sure to store the passwords in a hashed form.
If the login succeeds, the user is then stored into the session (or, rather, the LoginService class
is stored in the session along with the currently logged-in user. This way, we can group all
login/logout functionality into single class). Then, the page is refreshed. This forces Vaadin
to create a new instance of the MainLayout. Since a non-null user is now in the session, the MainLayout
will not perform the re-route to the login view; instead it will show the application layout.
There are four views:
- The WelcomeRoute which is accessible by all logged-in users;
- The UserRoute which is accessible by all users with roles
ROLE_USERandROLE_ADMIN - The AdminRoute which is accessible by users with the
ROLE_ADMINrole only
