Frequently Reported Issues (False Positives)

The settings script-src 'unsafe-inline' 'unsafe-eval' and style-src 'unsafe-inline' are required during Vaadin application start, that is, the bootstrap process. The bootstrap process that starts the application loads the widget set which is the client-side engine part of the application. This consists of precompiled JavaScript logic, for example, for the communication protocol, DOM control, Buttons, Layouts, etc., but not the application code. The widget set is a static resource. After it is loaded, the client-side engine needs to be started using JavaScript.eval().

Hence, these settings are architectural limitations in Vaadin, so that the framework can start its client-side engine in the browser.

Reported as: Missing or insecure “Content-Security-Policy” header

These values are not used as CSRF tokens, and they are not processed in a way that would let an attacker compromise the application state.

Vaadin uses its own CSRF scheme.

Many tools report a CSRF vulnerability when Vaadin fetches static resources. These requests cannot change the app state. Here is a list of resources that are safe to fetch without a CSRF token:

As mentioned earlier, some tools misrepresent getting static resources, especially client-engine JavaScript files (see the previous listing). These files should not be behind authentication, as they are necessary for the application to start, even before the user has authenticated.

Reported as: Authentication Bypass Using HTTP Verb Tampering

Some tools mark downloading the vaadinBootstrap.js file as an issue. This file is a required part of starting the application, and is a static resource.

Some tools that check for this do not check the content of the response, only the response status. Vaadin does not send server log files to the client, even though the response status is set to 200.

This happens when Vaadin sends user events to the server and receives JSON data back. The response content type is text/plain, even though the response is JavaScript. This is done because some older Portlet vendors do not treat JavaScript responses correctly, hence the client side receives incoherent instructions. The data returned from the server is never treated as a script on the client, so there is no security risk here.

This issue is reported because vaadinBootstrap.js indeed opens a new HTTP request. This is done to fetch the initial application state. On first request to an application URL, Vaadin replies with the bootstrap file, which, in turn loads the theme, widget set, and application state.

The way this request is done can not be used by an attacker to modify the application state. Hence, this is a false positive.

The X-Frame-Options are a way for web pages or applications to tell the browser that they should not be run inside frames (inside another page). This is done to try to ensure that these sites are not wrapped in malicious pages where attackers can intercept user actions.

Vaadin does not automatically set the X-Frame-Options HTTP header, because many times applications need to run inside frames. Developers can set this header either in their server options or by using the Java Servlet API (for example, using the Vaadin BootstrapListener or creating a Servlet Filter).