title: How to secure Vaadin flow application with Spring Security
body: <p>I'm trying to integrate vaadin 10 with spring security (using the spring project base provided by vaadin), and I'm confused on how they interact exactly. If I go to a protected url (in this example, "/about") typing it directly in the browser, the login page shows up. If I go to the same URL by clicking in a link from the UI, the page shows up even if I'm not authenticated. So I guess that Vaadin is not going through Spring Security's filter chain, but then how do I secure my resources inside the UI, and how can I share the authenticated user between vaadin and spring? Am I supposed to implement security twice? The documentation available doesn't seem to cover this, and every link on the internet has examples with Vaadin 7-8, which I've never used and seems to work differently from 10+.</p>
  
  <p>Does anyone know any resource about this, or can you enlighten me on how all of this works together so I can know what I'm doing? </p>
  
  <p>Here's my security configuration:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      private static final String[] ALLOWED_GET_URLS = {
          "/",
          //"/about",
          "/login/**",
          "/frontend/**",
          "/VAADIN/**",
          "/favicon.ico"
      };
  
      private static final String[] ALLOWED_POST_URLS = {
          "/"
      };
  
      //@formatter:off
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .csrf()
                  .disable()
              .authorizeRequests()
                  .mvcMatchers(HttpMethod.GET, ALLOWED_GET_URLS)
                      .permitAll()
                  .mvcMatchers(HttpMethod.POST, ALLOWED_POST_URLS)
                      .permitAll()
                  .anyRequest()
                      .fullyAuthenticated()
               .and()
                  .formLogin()
                      .loginPage("/login")
                      .permitAll()
              .and()
                  .logout()
                      .logoutSuccessUrl("/")
                      .permitAll();
      }
      //@formatter:on
  
  }
  </code></pre>