diff --git a/articles/flow/security/vaadin-security-configurer.adoc b/articles/flow/security/vaadin-security-configurer.adoc
index e4403af724..a873bc961c 100644
--- a/articles/flow/security/vaadin-security-configurer.adoc
+++ b/articles/flow/security/vaadin-security-configurer.adoc
@@ -89,6 +89,9 @@ public VaadinSecurityConfigurer loginView(String loginView, String logoutSuccess
 
 Configures the login view for use in a Hilla application and the logout success URL.
 
+[since:com.vaadin:vaadin@V25.3]#An unauthenticated request for a sub-resource of a protected path -- a stylesheet, a script, an image, or a font -- is answered with `401 Unauthorized` instead of being redirected to the login view.# A redirect can't be rendered as the resource the browser asked for, and it ends in a redirect loop that reports the login view rather than the resource that was denied. Requests for a page keep the redirect. The two are told apart by the `Sec-Fetch-Dest` header the browser sends, and a request without that header counts as a page request.
+
+
 ===== OAuth2 Configuration
 
 [source,java]