Migrating from Hilla 24 to 25 shows 403 for all UI requests

kardonsky.roman · August 21, 2026, 12:04pm

Hello.
I migrated my vaadin hilla 24 application to 25.2.6
After I press “login” on login form I see 403 error page instead of UI

this is my security config:

@RequiredArgsConstructor
@EnableWebSecurity
@Configuration
public class SecurityConfig {

	private static final List<String> unSecuredUriMatchers = Arrays.asList(
			"/monitoring/**",
			"/srr/**",
			"/swagger-ui/**",
			"/v3/api-docs/**",
			"/swagger-resources/**",
			"/api/**",
			"/error"
	);

	@Value("${app.auth.secret}")
	private String authSecret;

	@Value("${hilla.login-view.path}")
	private String hillaLoginViewPath;

	private final PasswordHasher passwordHasher;
	final OnlineUserManager userManager;

	@Bean
	public CustomPasswordEncoder passwordEncoder () {
		return new CustomPasswordEncoder(passwordHasher, userManager);
	}

	@Bean
	SecurityFilterChain securityFilterChain (HttpSecurity http) {
		http.headers(header->header.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin));
		// ignore csrf for all requests to make swagger working
		http.csrf(csrf->
				csrf.ignoringRequestMatchers("/**")
		);
		http.authorizeHttpRequests(auth->auth
				.requestMatchers(unSecuredUriMatchers.toArray(JArray.EMPTY_STR)).permitAll());

		// Disable creating and using sessions in Spring Security
		http.sessionManagement(
				management->
						management
								.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
		);

		// Register your login view to the view access checker mechanism
		http.with(VaadinSecurityConfigurer.vaadin(),
				configurer->configurer.loginView(hillaLoginViewPath));

		// Enable stateless authentication
		http.with(new VaadinStatelessSecurityConfigurer<>(),
				cfg->cfg
						.withSecretKey()
						.secretKey(new SecretKeySpec(Base64.getDecoder().decode(authSecret), JwsAlgorithms.HS256))
						.and()
						.issuer("a.b.c")
						.expiresIn(3600 * 24)
		);

		return http.build();
	}
}

kardonsky.roman · August 23, 2026, 8:34am

Here spring security logs (authentication is successful)

823 13:23:08.488 DEBUG [cat-handler-177] y.web.FilterChainProxy::Securing POST /ui/login
823 13:23:08.488 TRACE [cat-handler-177] y.web.FilterChainProxy::Invoking DisableEncodeUrlFilter (1/14)
823 13:23:08.488 TRACE [cat-handler-177] y.web.FilterChainProxy::Invoking WebAsyncManagerIntegrationFilter (2/14)
823 13:23:08.488 TRACE [cat-handler-177] y.web.FilterChainProxy::Invoking SecurityContextHolderFilter (3/14)
823 13:23:08.488 TRACE [cat-handler-177] y.web.FilterChainProxy::Invoking UpdateJwtCookiesFilter (4/14)
823 13:23:08.488 TRACE [cat-handler-177] y.web.FilterChainProxy::Invoking HeaderWriterFilter (5/14)
823 13:23:08.488 TRACE [cat-handler-177] y.web.FilterChainProxy::Invoking CsrfFilter (6/14)
823 13:23:08.488 TRACE [cat-handler-177] equestAttributeHandler::Wrote a CSRF token to the following request attributes: [_csrf, org.springframework.security.web.csrf.CsrfToken]
823 13:23:08.523 TRACE [cat-handler-177] ty.web.csrf.CsrfFilter::Did not protect against CSRF since request did not match And [IsNotHttpMethod [TRACE, HEAD, GET, OPTIONS], Not [Or [com.vaadin.flow.spring.security.VaadinSecurityConfigurer$$Lambda/0x00000000897a3400@6371e833, PathPattern [/ui/login]]]]
823 13:23:08.523 TRACE [cat-handler-177] y.web.FilterChainProxy::Invoking LogoutFilter (7/14)
823 13:23:08.525 TRACE [cat-handler-177] on.logout.LogoutFilter::Did not match request to PathPattern [POST /logout]
823 13:23:08.525 TRACE [cat-handler-177] y.web.FilterChainProxy::Invoking UsernamePasswordAuthenticationFilter (8/14)
823 13:23:08.525 TRACE [cat-handler-177] cation.ProviderManager::Authenticating request with DaoAuthenticationProvider (1/1)
823 13:23:08.567 DEBUG [cat-handler-177] AuthenticationProvider::Authenticated user
823 13:23:08.578 TRACE [cat-handler-177] AuthenticationStrategy::Preparing session with NullAuthenticatedSessionStrategy (1/2)
823 13:23:08.578 TRACE [cat-handler-177] AuthenticationStrategy::Preparing session with NullAuthenticatedSessionStrategy (2/2)
823 13:23:08.578 DEBUG [cat-handler-177] rdAuthenticationFilter::Set SecurityContextHolder to UsernamePasswordAuthenticationToken [Principal=TA{1.smsadmin, mt=[#mt], defSrc=ADMIN, pri=1, roles=[admin, smpp], null, rem=1300, acl=.*}, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=E9CBE4AB3D8812C4B789C9A64DDA3723], Granted Authorities=[ROLE_ADMIN, ROLE_SMPP, FactorGrantedAuthority [authority=FACTOR_PASSWORD, issuedAt=2026-08-23T10:23:08.567515400Z]]]
823 13:23:08.581 TRACE [cat-handler-177] iters.HstsHeaderWriter::Not injecting HSTS header since it did not match request to [Is Secure]
823 13:23:08.606 TRACE [cat-handler-178] y.web.FilterChainProxy::Trying to match request against DefaultSecurityFilterChain defined as 'securityFilterChain' in [class path resource [com/devinotele/sms/ui/security/SecurityConfig.class]] matching [any request] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, UpdateJwtCookies, HeaderWriter, Csrf, Logout, UsernamePasswordAuthentication, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, SessionManagement, ExceptionTranslation, Authorization] (1/1)
823 13:23:08.616 DEBUG [cat-handler-178] y.web.FilterChainProxy::Securing POST /connect/UsersEndpoint/getAuthenticatedUserInfo
823 13:23:08.616 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking DisableEncodeUrlFilter (1/14)
823 13:23:08.617 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking WebAsyncManagerIntegrationFilter (2/14)
823 13:23:08.617 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking SecurityContextHolderFilter (3/14)
823 13:23:08.619 TRACE [cat-handler-179] y.web.FilterChainProxy::Trying to match request against DefaultSecurityFilterChain defined as 'securityFilterChain' in [class path resource [com/devinotele/sms/ui/security/SecurityConfig.class]] matching [any request] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, UpdateJwtCookies, HeaderWriter, Csrf, Logout, UsernamePasswordAuthentication, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, SessionManagement, ExceptionTranslation, Authorization] (1/1)
823 13:23:08.619 DEBUG [cat-handler-179] y.web.FilterChainProxy::Securing GET /
823 13:23:08.619 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking DisableEncodeUrlFilter (1/14)
823 13:23:08.619 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking WebAsyncManagerIntegrationFilter (2/14)
823 13:23:08.619 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking SecurityContextHolderFilter (3/14)
823 13:23:08.622 TRACE [cat-handler-178] edAuthoritiesConverter::Looking for scopes in claim roles
823 13:23:08.622 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking UpdateJwtCookiesFilter (4/14)
823 13:23:08.623 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking HeaderWriterFilter (5/14)
823 13:23:08.623 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking CsrfFilter (6/14)
823 13:23:08.623 TRACE [cat-handler-178] equestAttributeHandler::Wrote a CSRF token to the following request attributes: [_csrf, org.springframework.security.web.csrf.CsrfToken]
823 13:23:08.623 TRACE [cat-handler-178] ty.web.csrf.CsrfFilter::Found a CSRF token in the request
823 13:23:08.623 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking LogoutFilter (7/14)
823 13:23:08.623 TRACE [cat-handler-178] on.logout.LogoutFilter::Did not match request to PathPattern [POST /logout]
823 13:23:08.623 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking UsernamePasswordAuthenticationFilter (8/14)
823 13:23:08.623 TRACE [cat-handler-178] rdAuthenticationFilter::Did not match request to PathPattern [POST /ui/login]
823 13:23:08.623 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking RequestCacheAwareFilter (9/14)
823 13:23:08.624 DEBUG [cat-handler-178] est.CookieRequestCache::saved request doesn't match
823 13:23:08.624 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking SecurityContextHolderAwareRequestFilter (10/14)
823 13:23:08.624 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking AnonymousAuthenticationFilter (11/14)
823 13:23:08.624 TRACE [cat-handler-178] usAuthenticationFilter::Did not set SecurityContextHolder since already authenticated JwtAuthenticationToken [Principal=org.springframework.security.oauth2.jwt.Jwt@64ae2b57, Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[ROLE_SMPP, FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=2026-08-23T10:23:08.622578Z], ROLE_ADMIN]]
823 13:23:08.624 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking SessionManagementFilter (12/14)
823 13:23:08.624 TRACE [cat-handler-179] edAuthoritiesConverter::Looking for scopes in claim roles
823 13:23:08.624 TRACE [cat-handler-178] AuthenticationStrategy::Preparing session with NullAuthenticatedSessionStrategy (1/2)
823 13:23:08.624 TRACE [cat-handler-178] AuthenticationStrategy::Preparing session with NullAuthenticatedSessionStrategy (2/2)
823 13:23:08.624 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking ExceptionTranslationFilter (13/14)
823 13:23:08.624 TRACE [cat-handler-178] y.web.FilterChainProxy::Invoking AuthorizationFilter (14/14)
823 13:23:08.624 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking UpdateJwtCookiesFilter (4/14)
823 13:23:08.624 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking HeaderWriterFilter (5/14)
823 13:23:08.624 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking CsrfFilter (6/14)
823 13:23:08.624 TRACE [cat-handler-178] ngAuthorizationManager::Authorizing POST /connect/UsersEndpoint/getAuthenticatedUserInfo
823 13:23:08.624 TRACE [cat-handler-179] equestAttributeHandler::Wrote a CSRF token to the following request attributes: [_csrf, org.springframework.security.web.csrf.CsrfToken]
823 13:23:08.625 TRACE [cat-handler-179] ty.web.csrf.CsrfFilter::Did not protect against CSRF since request did not match And [IsNotHttpMethod [TRACE, HEAD, GET, OPTIONS], Not [Or [com.vaadin.flow.spring.security.VaadinSecurityConfigurer$$Lambda/0x00000000897a3400@6371e833, PathPattern [/ui/login]]]]
823 13:23:08.625 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking LogoutFilter (7/14)
823 13:23:08.625 TRACE [cat-handler-179] on.logout.LogoutFilter::Did not match request to PathPattern [POST /logout]
823 13:23:08.625 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking UsernamePasswordAuthenticationFilter (8/14)
823 13:23:08.625 TRACE [cat-handler-179] rdAuthenticationFilter::Did not match request to PathPattern [POST /ui/login]
823 13:23:08.625 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking RequestCacheAwareFilter (9/14)
823 13:23:08.631 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking SecurityContextHolderAwareRequestFilter (10/14)
823 13:23:08.632 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking AnonymousAuthenticationFilter (11/14)
823 13:23:08.632 TRACE [cat-handler-179] usAuthenticationFilter::Did not set SecurityContextHolder since already authenticated JwtAuthenticationToken [Principal=org.springframework.security.oauth2.jwt.Jwt@64ae2b57, Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[ROLE_SMPP, FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=2026-08-23T10:23:08.624577800Z], ROLE_ADMIN]]
823 13:23:08.633 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking SessionManagementFilter (12/14)
823 13:23:08.633 TRACE [cat-handler-179] AuthenticationStrategy::Preparing session with NullAuthenticatedSessionStrategy (1/2)
823 13:23:08.633 TRACE [cat-handler-179] AuthenticationStrategy::Preparing session with NullAuthenticatedSessionStrategy (2/2)
823 13:23:08.633 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking ExceptionTranslationFilter (13/14)
823 13:23:08.634 TRACE [cat-handler-179] y.web.FilterChainProxy::Invoking AuthorizationFilter (14/14)
823 13:23:08.634 TRACE [cat-handler-179] ngAuthorizationManager::Authorizing GET /
823 13:23:08.637 TRACE [cat-handler-178] ngAuthorizationManager::Checking authorization on POST /connect/UsersEndpoint/getAuthenticatedUserInfo using org.springframework.security.authorization.SingleResultAuthorizationManager@59c38a9c
823 13:23:08.637 DEBUG [cat-handler-178] y.web.FilterChainProxy::Secured POST /connect/UsersEndpoint/getAuthenticatedUserInfo
823 13:23:08.660 TRACE [cat-handler-179] ngAuthorizationManager::Checking authorization on GET / using org.springframework.security.authorization.SingleResultAuthorizationManager@674241fe
823 13:23:08.661 TRACE [cat-handler-179] ptionTranslationFilter::Sending JwtAuthenticationToken [Principal=org.springframework.security.oauth2.jwt.Jwt@64ae2b57, Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[ROLE_SMPP, FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=2026-08-23T10:23:08.624577800Z], ROLE_ADMIN]] to access denied handler since access is denied
org.springframework.security.authorization.AuthorizationDeniedException: Access Denied
	at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:99)
	at org.springframework.security.web.ObservationFilterChainDecorator$ObservationFilter.wrapFilter(ObservationFilterChainDecorator.java:243)code

kardonsky.roman · August 24, 2026, 7:16am

Migrate to file router solved the problem