Vaadin Keyboard shortcut is getting blocked due to JavaScript Code as parameter Name

Question

When I use Enter Key as a click shortcut for Vaadin Button, it is getting blocked from the firewall in the browser.

I added enter key shortcut to a button using the below code:

Button login = new Button("Login");
login.addClickListener(event -> this.login());
login.addClickShortcut(Key.ENTER);

When I pressed enter key in the browser the request is getting blocked by our firewall. On inspecting the request I found the following Js expressions as a parameter name in the request being sent to the server.

(['Enter'].indexOf(event.code) !== -1 || ['Enter'].indexOf(event.key) !== -1) && !event.getModifierState('Shift') && !event.getModifierState('Control') && !event.getModifierState('Alt') && !event.getModifierState('AltGraph') && !event.getModifierState('Meta') && (event.stopPropagation() || true)

Below is the whole request body:

{
   "csrfToken": "20cbee30-71bf-4d76-830a-2871bd851238",
   "rpc": [
      {
         "type": "event",
         "node": 1,
         "event": "keydown",
         "data": {
            "event.shiftKey": false,
            "event.metaKey": false,
            "event.code": "Enter",
            "event.key": "Enter",
            "event.isComposing": false,
            "(['Enter'].indexOf(event.code) !== -1 || ['Enter'].indexOf(event.key) !== -1) && !event.getModifierState('Shift') && !event.getModifierState('Control') && !event.getModifierState('Alt') && !event.getModifierState('AltGraph') && !event.getModifierState('Meta') && (event.stopPropagation() || true)": true,
            "event.ctrlKey": false,
            "event.repeat": false,
            "event.location": 0,
            "event.altKey": false
         }
      }
   ],
   "syncId": 3,
   "clientId": 3
}

Is there a workaround for this without allowing the parameter through the firewall?

Answer 1

You need to configure your firewall to allow the request pass for this specific application. Workarounds may exists for simple cases, but add-ons and some components internally will use the same mechanism, so you will eventually run to it again.