Demonstrates a secured Vaadin-on-Kotlin-based application. Uses Vaadin Simple Security library. Requires Java 17+.
The project online demo.
Please see the Vaadin Boot documentation on how you run, develop and package this Vaadin-Boot-based app.
The application uses the username+password authorization, with users stored in an in-memory H2 SQL database (the User class). There are no views that could be accessed publicly - the user must log in first, in order to see any part of the app.
There are two users pre-created by the Bootstrap class:
- The 'user' user with the password of 'user' and the role of
ROLE_USER
- The 'admin' user with the password of 'admin' and two roles:
ROLE_ADMIN
andROLE_USER
The AppServiceInitListener configures
Vaadin to check authorization and redirects to the Login route if there's no user logged in.
The username and password are compared against the database. The User
class takes advantage
of the HasPassword
mixin which makes sure to store the passwords in a hashed form.
If the login succeeds, the user is then stored into the session (or, rather, the LoginService
class
is stored in the session along with the currently logged-in user. This way, we can group all
login/logout functionality into single class). Then, the page is refreshed. This forces Vaadin
to create a new instance of the MainLayout
. Since a non-null user is now in the session, the MainLayout
will not perform the re-route to the login view; instead it will show the application layout.
There are four views:
- The WelcomeRoute which is accessible by all logged-in users;
- The UserRoute which is accessible by all users with roles
ROLE_USER
andROLE_ADMIN
- The AdminRoute which is accessible by users with the
ROLE_ADMIN
role only