Release

.config/checkstyle/checkstyle.xml

@@ -85,6 +85,7 @@
 			<property name="tokens" value=" CLASS_DEF"/>
 		</module>
 		<module name="IllegalImport"/>
+		<module name="IllegalSymbol"/>
 		<module name="InterfaceIsType"/>
 		<module name="JavadocStyle">
 			<property name="checkFirstSentence" value="false"/>

CHANGELOG.md

@@ -1,3 +1,7 @@
+# 2.1.1
+* Vaadin
+  * `SecureVaadinRequestCache` no longer ignores `urlMapping`
+
 # 2.1.0
 * Renamed `OAuth2AuthenticationTokenUtil` -> `OAuth2AuthenticationTokenExtractor`
 * Updated dependencies

demo/integration-tests/pom.xml

@@ -86,7 +86,7 @@
 			<dependency>
 				<groupId>software.xdev</groupId>
 				<artifactId>testcontainers-advanced-imagebuilder</artifactId>
-				<version>2.4.1</version>
+				<version>2.5.0</version>
 			</dependency>
 			<dependency>
 				<groupId>org.testcontainers</groupId>

demo/pom.xml

@@ -82,7 +82,7 @@
 			<dependency>
 				<groupId>org.springdoc</groupId>
 				<artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
-				<version>3.0.2</version>
+				<version>3.0.3</version>
 			</dependency>
 
 			<!-- Caching for actuator -->
@@ -106,7 +106,7 @@
 			<dependency>
 				<groupId>org.mariadb.jdbc</groupId>
 				<artifactId>mariadb-java-client</artifactId>
-				<version>3.5.7</version>
+				<version>3.5.8</version>
 				<!-- https://mariadb.com/kb/en/about-mariadb-connector-j/#size-consideration -->
 				<exclusions>
 					<exclusion>
@@ -210,7 +210,7 @@
 				<plugin>
 					<groupId>io.github.git-commit-id</groupId>
 					<artifactId>git-commit-id-maven-plugin</artifactId>
-					<version>9.1.0</version>
+					<version>10.0.0</version>
 				</plugin>
 
 				<plugin>

vaadin/src/main/java/software/xdev/sse/vaadin/SecureVaadinRequestCache.java

@@ -38,6 +38,7 @@
 import com.vaadin.flow.router.RouteBaseData;
 import com.vaadin.flow.server.VaadinServlet;
 import com.vaadin.flow.server.VaadinServletService;
+import com.vaadin.flow.spring.security.RequestUtil;
 import com.vaadin.flow.spring.security.VaadinDefaultRequestCache;
 
 
@@ -56,6 +57,9 @@ public class SecureVaadinRequestCache extends VaadinDefaultRequestCache
 	@Autowired
 	protected ServletContext context;
 
+	@Autowired
+	protected RequestUtil requestUtil;
+
 	// Shortcut to save computation cost (no path is longer than this)
 	protected int defaultPathMaxLength = 255;
 	protected int defaultWildcardPathLengthAssumption = 48;
@@ -154,8 +158,8 @@ protected synchronized void initAllowedPaths()
 			.stream()
 			.map(RouteBaseData::getTemplate)
 			.filter(s -> !s.isBlank())
+			.map(this.requestUtil::applyUrlMapping)
 			.map(this::handleUrlParameterInPath)
-			.map(s -> "/" + s)
 			.collect(Collectors.toSet());
 
 		LOG.debug("Allowed paths: {}", allowedPaths);