Vaadin-on-Kotlin Security Demo for Vaadin
Demonstrates a secured Vaadin-on-Kotlin-based application. Uses Vaadin Simple Security library. Requires Java 17+.
The project online demo.
Please see the Vaadin Boot documentation on how you run, develop and package this Vaadin-Boot-based app.
About the application
The application uses the username+password authorization, with users stored in an in-memory H2 SQL database (the User class). There are no views that could be accessed publicly - the user must log in first, in order to see any part of the app.
There are two users pre-created by the Bootstrap class:
- The 'user' user with the password of 'user' and the role of
- The 'admin' user with the password of 'admin' and two roles:
The AppServiceInitListener configures
Vaadin to check authorization and redirects to the Login route if there's no user logged in.
The username and password are compared against the database. The
User class takes advantage
mixin which makes sure to store the passwords in a hashed form.
If the login succeeds, the user is then stored into the session (or, rather, the
is stored in the session along with the currently logged-in user. This way, we can group all
login/logout functionality into single class). Then, the page is refreshed. This forces Vaadin
to create a new instance of the
MainLayout. Since a non-null user is now in the session, the
will not perform the re-route to the login view; instead it will show the application layout.
There are four views:
- The WelcomeRoute which is accessible by all logged-in users;
- The UserRoute which is accessible by all users with roles
- The AdminRoute which is accessible by users with the