Vaadin's LoginForm flickering when entering invalid credentials

Hi,
I recently got back to developing in Vaadin after 8 years of break.

I have followed the tutorial to setup Vaadin 24 alongside Spring Security and everything works great apart from one minor issue.

When the user enters invalid credentials, the whole login page is reloaded. I would rather expect just an AJAX request without triggering full page reload. This behavior will be especially annoying for the users as I set a custom background image (using CSS) for the login page which is different from the rest of the application.

Here is the gif that illustrates the flickering.
vaadin

You can see that for a brief moment when the page is being reloaded (redirected?) the background becomes fully grey/blue.

My security config is here:

http.authorizeHttpRequests(auth -> auth.requestMatchers(new AntPathRequestMatcher("/public/**"))
              .permitAll());
super.configure(http);
setLoginView(http, LoginView.class);

And my login view code is here:

@Route("login")
@PageTitle("obfuscated")
@AnonymousAllowed
public class LoginView extends VerticalLayout implements BeforeEnterObserver {

    private final LoginForm login = new LoginForm();

    public LoginView(){
        addClassName("login-view");
        addClassName("obfuscated");
        setSizeFull();
        setAlignItems(Alignment.CENTER);
        setJustifyContentMode(JustifyContentMode.CENTER);
        login.setAction("login");
        add(new H1("obfuscated"), login);
        //login.addLoginListener(l -> UI.getCurrent().navigate("/home"));
    }

    @Override
    public void beforeEnter(BeforeEnterEvent beforeEnterEvent) {
        // inform the user about an authentication error
        if(beforeEnterEvent.getLocation()
                .getQueryParameters()
                .getParameters()
                .containsKey("error")) {
            login.setError(true);
        }
    }
}

That’s intended because the login is done with spring security (form post request) - theoretically you can overwrite this by using your own security integration, but I would highly suggest not to.

1 Like

Thank you.
I think this means that if I desire different behavior I need to implement it on my own.