VaadinWebSecurity does not ignore CSRF for Flow PUSH connection request

[mcollovati]

Description of the bug

Given a Vaadin 24.3 application with security configured through VaadinWebSecurity, the PUSH connections fail right after login with a 403 error after login, because of Spring Security complaining about an invalid CSRF token.
However, when the protected page is reloaded the PUSH connections are correctly established

2024-04-02T08:47:06.190+02:00 DEBUG 65418 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : Securing POST /VAADIN/push?v-r=push&debug_window&token=bbcccf73-3299-443e-a767-066584ca8495&X-Atmosphere-Transport=close&X-Atmosphere-tracking-id=44c5fba3-a76a-4c86-a56c-50c17dcc887f
2024-04-02T08:47:06.190+02:00 DEBUG 65418 --- [nio-8080-exec-3] w.c.HttpSessionSecurityContextRepository : Retrieved SecurityContextImpl [Authentication=UsernamePasswordAuthenticationToken [Principal=org.springframework.security.core.userdetails.User [Username=user, Password=[PROTECTED], Enabled=true, AccountNonExpired=true, CredentialsNonExpired=true, AccountNonLocked=true, Granted Authorities=[ROLE_USER]], Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=0:0:0:0:0:0:0:1, SessionId=2949F5403A070331A08F02896D9BD6D9], Granted Authorities=[ROLE_USER]]]
2024-04-02T08:47:06.190+02:00 DEBUG 65418 --- [nio-8080-exec-3] o.s.security.web.csrf.CsrfFilter         : Invalid CSRF token found for http://localhost:8080/VAADIN/push?v-r=push&debug_window&token=bbcccf73-3299-443e-a767-066584ca8495&X-Atmosphere-Transport=close&X-Atmosphere-tracking-id=44c5fba3-a76a-4c86-a56c-50c17dcc887f

The issue seems to be that the Flow PUSH connections requests (/VAADIN/push) are no more identified as Framework requests by HandlerHelper.isFrameworkInternalRequest().
To be noted For Hilla PUSH connections, there is a specific method (HandlerHelper.isHillaPush()) that checks for /HILLA/push

Expected behavior

Spring CSRF check should be skipped for Vaadin PUSH connection, since they have their own built-in protection mechanism.

Minimal reproducible example

• Use start.vaadin.com to create an application with protected views and login page
• Try to navigate to a protected page, the login view should be shown
• Enter credential and verify that Vaadin PUSH connection requests fail with a 403 status code

Versions

• Vaadin / Flow version: 24.3
• Java version: 17

[mcollovati]

It looks like only ping requests are failing, since they are doing a POST.
The connection is established through a GET request, so CSRF is not checked

[mcollovati]

It might be related to the PUSH request error reported in vaadin/kubernetes-kit#111

[vaadin-bot]

This ticket/PR has been released with Vaadin 24.4.0.alpha21 and is also targeting the upcoming stable 24.4.0 version.

[vaadin-bot]

This ticket/PR has been released with Vaadin 24.3.10.