defaultSuccessUrl don't work in SecurityFilterChain

[heinerjost]

Describe the bug

In Vaadin V24.9.0-alpha6 VaadinWebSecurity is deprecated. I changed my Code to SecurityFilterChain:

@Bean SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests( authorize -> authorize.requestMatchers("/images/**").permitAll());

	http.rememberMe(rememberMe ->
	{
		rememberMe.key(remembermekey).tokenValiditySeconds(remberme_tokenvalidity)
				.tokenRepository(persistentTokenRepository());
	});

	http.logout((logout) -> logout.permitAll());
	http.formLogin(fl ->
	{
		fl.defaultSuccessUrl("/start");
	});

	http.with(VaadinSecurityConfigurer.vaadin(), configurer ->
	{
		// This is important to register your login view to the
		// navigation access control mechanism:
		configurer.loginView(LoginView.class);
	});

	return http.build();
}

The statement "fl.defaultSuccessUrl("/start")" has no Effect. The app navigates to "/".

Expected-behavior

App navigates to "/start" after successful Login

Reproduction

See above code

System Info

Mac OS 15.6.1

OpenJDK Runtime Environment Temurin-24.0.2+12 (build 24.0.2+12)

Vaadin 24.9.0-alpha6

[knoobie]

Are you sure that worked with the old config? If yes, might sound like you got lucky. Custom success and error login handler are not implemented / available atm.

Edit: a hack / workaround might be to create a bean that extends https://github.com/vaadin/flow/blob/eda19b9ecd987b16cd499be503deb07c5457875e/vaadin-spring/src/main/java/com/vaadin/flow/spring/security/VaadinSavedRequestAwareAuthenticationSuccessHandler.java and do your stuff in there

Related to vaadin/flow#18071

Another workaround: https://vaadin.com/docs/latest/flow/routing/lifecycle using a global before enter listener

[heinerjost]

This code works:

import javax.sql.DataSource;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl;
import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;

import com.vaadin.flow.spring.security.VaadinSecurityConfigurer;
import com.vaadin.flow.spring.security.VaadinWebSecurity;

import de.jostnet.ver1cloud.views.Public.LoginView;

@EnableWebSecurity
@Configuration
public class SecurityConfiguration extends VaadinWebSecurity
{
@Autowired
private DataSource dataSource;

@Value("${rememberme.key}")
private String remembermekey;

@Value("${rememberme.tokenvalidity}")
private int remberme_tokenvalidity;

@Bean
public PasswordEncoder passwordEncoder()
{
	return new BCryptPasswordEncoder();
}

@Override
protected void configure(HttpSecurity http) throws Exception
{
	http.authorizeHttpRequests(
			authorize -> authorize.requestMatchers("/images/**").permitAll());

	http.rememberMe(rememberMe ->
	{
		rememberMe.key(remembermekey).tokenValiditySeconds(remberme_tokenvalidity)
				.tokenRepository(persistentTokenRepository());
	});

	http.logout((logout) -> logout.permitAll());

	super.configure(http);
	setLoginView(http, LoginView.class);

	http.formLogin(fl ->
	{
		fl.defaultSuccessUrl("/start");
	});
}

@Bean
public PersistentTokenRepository persistentTokenRepository()
{
	JdbcTokenRepositoryImpl tokenRepo = new JdbcTokenRepositoryImpl();
	tokenRepo.setDataSource(dataSource);
	return tokenRepo;
}

}

[knoobie]

Did you try to switch the order of operations?

[heinerjost]

yes. I've tried to to set defaultSuccessUrl before and after setLoginView().

[Jusius]

.formLogin(form -> form
.loginPage("/login")
.defaultSuccessUrl("/home", true)
.permitAll())

i have success doing it like this , using the alwaysUse "true" statement

forgot to mention that i still use 24.8.X version