Vaadin authentication best practice
authentication, spring-security, vaadin
Solution
There are a lot of different ways for authentication in Vaadin.
- Vaadin base authentication.
- For Vaadin 6, try `LoginForm`.
- For Vaadin 7, you can use the new & improved replacement implementation of `LoginForm` first available as a Add-On, then later built into Vaadin 7.7.
- For Vaadin 8, use that same re-implemented `LoginForm`.
- For Vaadin Flow, not implemented as of version 12. You could peruse the open source code, and build something similar. The “Listener” support is built into the superclasses, so you are not starting from scratch.
- Add value into user session and check that value in init() method. (also easy)
- Basic authentication (see tomcat example) (sometimes it very useful for customer, but usually you get container specific problem.)
- Spring Security Vaadin 7.1 + Spring-Security Integration running in Tomcat Server (people loves Spring)
- Apache shiro (never try but it was one of possible ways)
I recommend you to select 1 or 2 if you want make it easy or 4 if you want power security system.
Problem
I am interested in the best practice in authentication in Vaadin I think there is mainly two option here: - ThreadLocal (can cause Out of memory, can have the same thread for different users) - Spring Security + Vaadin integration (seems a little too much) Which one do you prefer and why? (Security issues, easy development, other factors)