[peholmst]

Review risk: two-way door. Docs and examples only: five new reference pages, ten removed pages with redirects, merges into three Flow security pages, and link updates. Reverting brings the old pages back.

Summary

Moves the security reference for React views from the Hilla section to the Flow security reference. The new pages are under articles/flow/security/react-views/, including stateless authentication. This is the sixth step of dissolving the Hilla section, after #6611, #6616, #6618, #6620 and #6621. Full-stack signals follow in the next pull request.

The new pages are reference only: what the access rules are, how Vaadin checks them, and what the APIs do. They link to other reference pages. The step-by-step setup stays in Building Apps > Secure React Views, which now links to the reference instead of the reference linking to it.

Every statement is checked against main of vaadin/flow and vaadin/hilla. The behavior is also checked in a scratch 25.4.0-alpha5 application with Spring Security, using curl and a browser. This pull request targets main only, so it gets no target/v25.3 label.

What changed

• New pages in flow/security/react-views/:
  • index.adoc: the security model, the default access of services, React views and Flow views, what VaadinSecurityConfigurer does for React views and services, and data kept in the browser.
  • service-access-control.adoc: the access annotations and their precedence, role checks, 401 versus 403, the current user, auditing denied calls, and CSRF.
  • authentication.adoc: the React login view, the user information method, configureAuth(), useAuth(), login() and logout(), and expired sessions.
  • view-access-control.adoc: the three places where loginRequired and rolesAllowed are checked (the router, the menu, page loads), role names, hasAccess(), protectRoutes(), and Flow and React views together.
• Moved page: flow/security/react-views/stateless-authentication.adoc, rewritten as a reference for VaadinStatelessSecurityConfigurer, its cookies, and the contents of the token. It states that stateless authentication is intended for React views only, and that its behavior with Flow views is undefined.
• Merges:
  • spring/security-configuration.adoc: the static getDefaultHttpSecurityPermitMatcher() and getDefaultWebSecurityIgnoreMatcher() matchers.
  • protections/vulnerabilities.adoc: the double-submit cookie check that services use without Spring Security's CSRF protection, and its relation to disable-xsrf-protection.
• Examples: the user information service now allows anonymous calls and returns null when nobody is logged in, using AuthenticationContext. Its record has a roles property, which configureAuth() reads by default. A new ProjectService shows the access annotations. The login view, the session-expiration overlay and the connect client are rewritten. The examples that only the removed pages used are deleted.
• Corrections and additions compared with the old pages, each confirmed in the scratch application:
  • A service without annotations is denied to everyone. Controlling Service Access and Best Practices also said that it needs only a logged-in user.
  • The session-expiration example said that the failed call continues after the login. It doesn't: login() returns no token, so InvalidSessionMiddleware doesn't send the call again, and login() reloads the page at /. The new example reloads the current page. A user information method that allows only logged-in users also opened the overlay for every visitor who isn't logged in.
  • After a session expires, calls to anonymous methods fail with 401 as well, because the CSRF token belonged to the old session.
  • When Spring Security has already rejected an anonymous call, no EndpointInvocation event is published. Spring Security publishes its own event, with the request as its object. The Auditing section said that the anonymous user arrives in the EndpointInvocation event.
  • The old role example used rolesAllowed: ['ROLE_USER'] with roles that never contained that name.
  • The old pages showed the removed useRouteMetadata, the deprecated requiresLogin, and VaadinRequest.getCurrent().getUserPrincipal().
• Removed pages, each with a redirect: the ten hilla/guides/security pages. Offline authentication, which was built on Lit-era APIs, and the best-practices, introduction and vulnerabilities pages go to the matching Flow pages. The nine Lit redirects that led to these pages now point straight at the new pages.
• Links: Routing, Browser-Callable Services, Client and Security Configuration now link to the new reference pages instead of the Building Apps guide. Secure React Views links to the reference. The full-stack signals page linked to the removed introduction.

Test summary

• npm run check-redirects passes.
• mvn spotless:apply and mvn compile pass. npx eslint frontend/demo/auth passes.
• The frontend examples type-check in the scratch 25.4.0-alpha5 application against the generated services. The login view and the session-expiration overlay ran there.
• Checked with curl and in the browser in the scratch application:
  • service calls as an anonymous user, a user, and an administrator;
  • page loads, client-side navigation and menus;
  • expired sessions;
  • audit events;
  • stateless authentication across a server restart;
  • the double-submit cookie without Spring Security.
• Every cross reference in the new and changed lines resolves to an existing page and anchor.
• Vale: no errors or warnings on the added and changed lines.
• Asciidoctor renders the new and changed pages, with all includes and tags resolved.
• I didn't run a full dspublisher build locally.

Stateless authentication is documented as intended for applications whose views are all React views, with undefined behavior for Flow views. Flow views keep their UI state in the HTTP session in any case.

Behaviors that came up during testing, which the pages describe as they are:

• On a page load of a React view with loginRequired: true, Spring Security compares rolesAllowed with the granted authorities exactly. The menu and the browser compare differently. rolesAllowed: ['ADMIN'] therefore answers 403 to an administrator who reloads the page. View Access Control documents the three comparisons, and recommends writing the full authority names, such as ROLE_ADMIN (Page load of a React view checks rolesAllowed without the role prefix flow#26962).
• InvalidSessionMiddleware retries a call only when the LoginResult has a token, which login() never returns (InvalidSessionMiddleware never retries the call, because login() returns no token hilla#7048).

Not changed here: the role example in Building Apps > Secure React Views hits the 403 above on reload, and its getRoles code doesn't type-check. That guide gets a separate pull request.

🤖 Generated with Claude Code

[vaadin-review-bot]

Reviewed the changes — left 1 comment.

	Finding
🧩	After a second failed login, the login view's form stays disabled and shows no error.

[github-actions]

Preview Deployment

This PR has been deployed for preview.

URL: https://docs-preview-pr-6622.fly.dev

Changed pages

Added content is highlighted in green; removed content is marked in red on each page.

• building-apps/react/security — modified, +5/-3 lines, 3 removal marker(s)
• flow/react-views/browser-callable-services — modified, +1/-1 lines, 1 removal marker(s)
• flow/react-views/browser-callable-services/client — modified, +1/-1 lines, 1 removal marker(s)
• flow/react-views/routing — modified, +2/-2 lines, 2 removal marker(s)
• flow/security/protections/vulnerabilities — modified, +5/-1 lines, 1 removal marker(s)
• flow/security/react-views — added, +58/-0 lines
• flow/security/react-views/authentication — added, +148/-0 lines, 20 removal marker(s)
• flow/security/react-views/service-access-control — added, +125/-0 lines
• flow/security/react-views/view-access-control — added, +112/-0 lines
• flow/security/spring/security-configuration — modified, +29/-1 lines, 1 removal marker(s)
• flow/security/spring/stateless-authentication — added, +103/-0 lines, 4 removal marker(s)
• hilla/guides/full-stack-signals — modified, +1/-1 lines, 1 removal marker(s)

Other changed files

• articles/hilla/guides/security/authentication.adoc (deleted)
• articles/hilla/guides/security/best-practices.adoc (deleted)
• articles/hilla/guides/security/configuring.adoc (deleted)
• articles/hilla/guides/security/index.adoc (deleted)
• articles/hilla/guides/security/intro.adoc (deleted)
• articles/hilla/guides/security/offline-auth.adoc (deleted)
• articles/hilla/guides/security/session-expiration.adoc (deleted)
• articles/hilla/guides/security/spring-login.adoc (deleted)
• articles/hilla/guides/security/spring-stateless.adoc (deleted)
• articles/hilla/guides/security/vulnerabilities.adoc (deleted)
• articles/hilla/_shared/guides/security/_index.adoc (deleted)
• articles/hilla/_shared/guides/security/_session-expiration.adoc (deleted)
• articles/hilla/_shared/guides/security/_spring-login.adoc (deleted)
• frontend/demo/auth/AboutView.tsx (deleted)
• frontend/demo/auth/App.tsx (deleted)
• frontend/demo/auth/MainLayout.tsx (deleted)
• frontend/demo/auth/authRoles.ts (deleted)
• frontend/demo/auth/index.tsx (deleted)
• frontend/demo/auth/routes.tsx (deleted)
• frontend/demo/auth/routing.ts (deleted)
• frontend/demo/fusion/authentication/auth.ts (deleted)
• src/main/java/com/vaadin/demo/fusion/security/access/package-info.java (added)
• src/main/java/com/vaadin/demo/fusion/security/authentication/SecurityConfigDemo.java (deleted)
• src/main/java/com/vaadin/demo/fusion/security/authentication/package-info.java (added)

Built from 6ccf233

[vaadin-review-bot]

Reviewed the changes — left 1 comment.

	Finding
💬	The page no longer tells the reader to render the session-expiration overlay. Its wording suggests that the main layout renders it automatically.