"Invalid JSON from server" even when Push response contains Vaadin-Refresh

Description of the bug

Our Vaadin 22 application is fronted by an SSO solution. When the session has timed out, the login page is returned as HTML when Vaadin performs a request and expects JSON. That login page contains the string Vaadin-Refresh.

In the past this caused Vaadin to refresh the page, but now the following error is shown:

As you can see, the string Vaadin-Refresh is still present. But we did upgrade from Vaadin 14 to Vaadin 22 and from Spring Boot 1.5.x to 2.5.x not so long ago.

Expected behavior

No error should be shown and the page should be refreshed instead.

Minimal reproducible example

I don’t know of any other way to reproduce this than to add a reverse proxy in front of a Vaadin application and make it return an HTML page containing Vaadin-Refresh at some point when Vaadin makes an internal request.

Versions

• Vaadin / Flow version: 22.0.9
• Java version: 1.8
• Application Server (if applicable): Spring Boot 2.5.14

[HermanBovens]

I had a similar problem and I managed to fix it by using a space after the URL to redirect e.g.

As you can see in the screenshot, there is no URL (and there is a space). I tried the regex from the code and it matches this content. But it appears to be a Push response and the regex check is not done in that case.

[vaadin-bot]

This ticket/PR has been released with Vaadin 14.9.0.beta1 and is also targeting the upcoming stable 14.9.0 version.