Conversation
A stylesheet, script, image or font requested without a session used to be redirected to the login view, which ended in a redirect loop that hid the resource that was denied. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Preview DeploymentThis PR has been deployed for preview. URL: https://docs-preview-pr-6102.fly.dev Changed pagesAdded content is highlighted in green; removed content is marked in red on each page.
Built from be9182b |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents vaadin/flow#25593
security · flow/security · Spring Security applications with a
configured login view
An unauthenticated request for a protected stylesheet, script, image or
font used to be redirected to the login view. The redirect couldn't
work and ended in an
ERR_TOO_MANY_REDIRECTSerror that pointed at thelogin view instead of the blocked resource. Such requests now get a
plain
401 Unauthorized. The configurer reference described neitherthe old behavior nor the new one.
Risks:
✅ Docs only. One paragraph added, no moved anchors.
Added a paragraph to the Login View Configuration section of the
VaadinSecurityConfigurerreference, with a since badge.Said which requests get the
401, which keep the redirect, and thatthe
Sec-Fetch-Destheader decides, so a browser that doesn't sendit is treated as asking for a page.
🤖 Generated with Claude Code