From 3df0e9719d02a0609c02cb19878bbd9e11669330 Mon Sep 17 00:00:00 2001 From: mikhail Date: Mon, 21 Sep 2026 11:51:36 +0300 Subject: [PATCH] docs: protected sub-resources answer 401 instead of redirecting A stylesheet, script, image or font requested without a session used to be redirected to the login view, which ended in a redirect loop that hid the resource that was denied. Co-Authored-By: Claude Opus 5 (1M context) --- articles/flow/security/vaadin-security-configurer.adoc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/articles/flow/security/vaadin-security-configurer.adoc b/articles/flow/security/vaadin-security-configurer.adoc index e4403af724..a873bc961c 100644 --- a/articles/flow/security/vaadin-security-configurer.adoc +++ b/articles/flow/security/vaadin-security-configurer.adoc @@ -89,6 +89,9 @@ public VaadinSecurityConfigurer loginView(String loginView, String logoutSuccess Configures the login view for use in a Hilla application and the logout success URL. +[since:com.vaadin:vaadin@V25.3]#An unauthenticated request for a sub-resource of a protected path -- a stylesheet, a script, an image, or a font -- is answered with `401 Unauthorized` instead of being redirected to the login view.# A redirect can't be rendered as the resource the browser asked for, and it ends in a redirect loop that reports the login view rather than the resource that was denied. Requests for a page keep the redirect. The two are told apart by the `Sec-Fetch-Dest` header the browser sends, and a request without that header counts as a page request. + + ===== OAuth2 Configuration [source,java]