Security with Spring Security in Vaadin 25

Use the Vaadin MCP tools (search_vaadin_docs, get_component_java_api, get_component_styling) to look up the latest documentation whenever uncertain about a specific API detail. Always set vaadin_version to "25" and ui_language to "java".

For an exact Java API signature or to read source, use the javadoc MCP (mcp__javadoc__* — find via ToolSearch javadoc if not loaded) to read Javadoc and sources from Maven Central instead of unpacking jars from ~/.m2.

When to Use This Skill vs. Others

This skill covers: Spring Security configuration with VaadinSecurityConfigurer, login views with LoginForm, view access control annotations (@AnonymousAllowed, @PermitAll, @RolesAllowed, @DenyAll), AuthenticationContext, logout handling, and OAuth2/OpenID Connect integration with providers like Google, Keycloak, GitHub, and Okta.

Use views-and-navigation instead when the question is about @Route, @Layout, AppLayout, SideNav, or URL parameters. This skill covers how to secure views, not how to create or navigate between them.

Use client-side-views instead when securing React/Hilla views with ViewConfig.loginRequired and ViewConfig.rolesAllowed. This skill covers Java/Flow view security, though the annotation-based approach also applies to @BrowserCallable endpoints.

Setting Up Spring Security

Add the Spring Security starter dependency: