Exception when changing security configuration when using Hotswap Agent

[Artur-]

Description of the bug

Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.web.SecurityFilterChain]: Factory method 'filterChain' threw exception with message: Already using login as the login view
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:178)
        at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:644)
        ... 39 more
Caused by: java.lang.IllegalStateException: Already using login as the login view
        at com.vaadin.flow.server.auth.NavigationAccessControl.throwIfLoginViewSet(NavigationAccessControl.java:228)
        at com.vaadin.flow.server.auth.NavigationAccessControl.setLoginView(NavigationAccessControl.java:213)
        at com.vaadin.flow.spring.security.VaadinWebSecurity.setLoginView(VaadinWebSecurity.java:425)
        at com.vaadin.flow.spring.security.VaadinWebSecurity.setLoginView(VaadinWebSecurity.java:387)
        at com.example.application.security.SecurityConfiguration.configure(SecurityConfiguration.java:37)
        at com.vaadin.flow.spring.security.VaadinWebSecurity.filterChain(VaadinWebSecurity.java:146)
        at com.example.application.security.SecurityConfiguration$$SpringCGLIB$$0.CGLIB$filterChain$19(<generated>)
        at com.example.application.security.SecurityConfiguration$$SpringCGLIB$$FastClass$$2.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
        at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:348)
        at com.example.application.security.SecurityConfiguration$$SpringCGLIB$$0.filterChain(<generated>)
        at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
        at java.base/java.lang.reflect.Method.invoke(Method.java:580)
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:146)
        ... 40 more

Expected behavior

No exceptions

Minimal reproducible example

New app -> include security conf -> run with HA -> change security conf

Versions

Hilla: 24.5.0.alpha13
Flow: 24.5-SNAPSHOT
Vaadin: 24.5.0.alpha15
Copilot: 24.5-SNAPSHOT
Frontend Hotswap: Enabled, using Vite
OS: aarch64 Mac OS X 14.6.1
Java: JetBrains s.r.o. 21.0.2
Browser: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Java Hotswap: false
IDE Plugin: ☑ 1.0.0

[mshabarov]

Flow shouldn't throw and should do nothing in setLoginView, if the new Java class is the same as before. It simply means a hotreload.

[vaadin-bot]

This ticket/PR has been released with Vaadin 24.5.0.beta2 and is also targeting the upcoming stable 24.5.0 version.

[vaadin-bot]

This ticket/PR has been released with Vaadin 24.4.13.