Always serve static files from VAADIN in the context root

[Artur-]

Description of the bug

In most cases, you have only one servlet deployed as /* in your application.

In cases when you have other web frameworks in use, REST endpoints etc you might map your application to /myapp/* instead.

In the rare cases where you have multiple Vaadin servlets in the same application, you might have /myapp/* and /admin/* mappings.

Right now the bundle files are loaded from

• /VAADIN in the /* mapping case
• /myapp/VAADIN in the /myapp/* mapping case
• /myapp/VAADIN AND /admin/VAADIN in the multi mapping case

Expected behavior

In all cases, the static files (JS bundle files, vaadinPush script etc) should be loaded from VAADIN inside the context root. Thus is you have multiple servlet mappings, you still load e.g. web components only once from /VAADIN and not from both /myapp/VAADIN and /admin/VAADIN.

Any dynamic content related to the servlet should still be served through /myapp/VAADIN/dynamic.

Minimal reproducible example

Versions

Vaadin: 23.0.9
Flow: 23.0.7
Java: Homebrew 17.0.1
OS: aarch64 Mac OS X 12.3.1
Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36

[vaadin-bot]

This ticket/PR has been released with Vaadin 23.1.0.rc1 and is also targeting the upcoming stable 23.1.0 version.

[knoobie]

@Artur- Just for clarification, which is probably important for a lot of people:

If I deploy a spring boot application with a configuration like this:

server:
  servlet:
    context-path: /web

Vaadin's static ressources are still served with /web/VAADIN, right?

[Artur-]

Yes, the only affect this change should have had is if you map your servlet with a separate path inside the context path. Then earlier it was using /contextpath/servletpath/VAADIN for static files and now it is using /contextpath/VAADIN

[archiecobbs]

Yes, the only affect this change should have had is if you map your servlet with a separate path inside the context path. Then earlier it was using /contextpath/servletpath/VAADIN for static files and now it is using /contextpath/VAADIN

Um, no.

When a non-empty servlet path is in use, this change:

• Breaks almost all Vaadin add-ons
• Creates a security issue

Pleas see #14341 for details.