Include csrf token in form login request

[Artur-]

When using Vaadin 20+ with Spring Security, the Spring CSRF token is included as a meta tag on the page. This needs to be included in a form login request to the standard Spring Security login processor for login to work. What would be a good way to integrate this so especially the Java version LoginOverlay would automatically include the CSRF token (if available) when using e.g. setAction("login");

The information is available as

<meta name="_csrf_parameter" content="_csrf">
<meta name="_csrf_header" content="X-CSRF-TOKEN">
<meta name="_csrf" content="71dac59f-34ee-4b31-b478-2891cbd0c55d">

When doing a form post, it should be used as

<input type="hidden" name="_csrf" value="71dac59f-34ee-4b31-b478-2891cbd0c55d">

or passed as a header

X-CSRF-TOKEN: 71dac59f-34ee-4b31-b478-2891cbd0c55d

[rolfsmeds]

Description

Include CSRF token in form login request

Use cases

As a developer
I want the CSRF token to be automatically included in the login request passed by the Login component
So that I can use Login with Spring Security

Acceptance criteria

• See description of passing the token as a hidden form field or request header in the original issue description.
• The token should be included automatically when using CSRF
• Mention this feature in the Technical section of Login component docs https://vaadin.com/docs/latest/ds/components/login

General criteria

• UX/DX tests in Alpha

• Documentation:

• How to test?

• Limitations:

[knoobie]

@Artur- you mentioned some days ago in discord that once CSRF is used, the default GET request to /logout won't logout the user anymore. Now that e.g. LoginOverlay supports CSRF and some don't have to disable it.. shouldn't there be a Logout Component which sends a POST request to /logout created by Vaadin or should this limitation be mentioned somewhere?

[Artur-]

If you go to https://start.vaadin.com/ and enable authentication, you have an AuthenticatedUser.logout() method you can use in Flow for logging out and a logout function exported for Fusion. Is there something else needed?

[knoobie]

Thanks for the information. That should be enough :) I haven't seen the latest additions to start.vaadin.com - looks really interesting!