Enable VaadinWebSecurity to use JWT coming from a Filter

In some scenarios, a Vaadin application may be called with a valid JWT in the header.

For that a Filter is used that populates the SecurityContext like in this example: https://github.com/simasch/spring-jwt

Now when using VaadinWebSecurity this approach may not work because the JWT must be used in the browser code and sent back to the server with every request.

Currently, we have to create our own security configuration in this scenario, but then we cannot use annotation-based security.

Please add support for such a scenario.

[simasch]

@gsustek I think my initial statement is wrong. We CAN use annotation-based security but we still need our own filter because we must add some roles. But I definitely have to check the resource server configuration

[gsustek]

@simasch Can you please explain a little bit more with examples why

Currently, we have to create our own security configuration in this scenario, but then we cannot use annotation-based security. becasue, “Vaadin has a spring security integration and is able to use the spring security annotations.”

Does this influence resourceServer springsecurity configuration case only?

Regards, Goran.

In some scenarios, a Vaadin application may be called with a valid JWT in the header.

For that a Filter is used that populates the SecurityContext like in this example: https://github.com/simasch/spring-jwt

Now when using VaadinWebSecurity this approach may not work because the JWT must be used in the browser code and sent back to the server with every request.

Currently, we have to create our own security configuration in this scenario, but then we cannot use annotation-based security.

Please add support for such a scenario.