You might have heard about the Navigator class in Vaadin Framework. In short, the Navigator class allows you to pair URI fragments with UI components. When the fragment part changes in the browser, the associated UI component is rendered. It also allows you to programmatically navigate to a specific UI component by specifying its associated fragment. For example:

public class VaadinUI extends UI { 
    @Override 
    protected void init(VaadinRequest vaadinRequest) { 
        Navigator navigator = new Navigator(this, this); 
         
        navigator.addView("view1", new View1()); 
        navigator.addView("view2", new View2()); 
    } 
} 

When you create a Navigator, you specify the UI to which the Navigator is attached and a ComponentContainer (such as VerticalLayout, for example), whose content will be replaced when the view is made visible (when changing the fragment in the browser, for example). You associate view names to UI components by using the addView method. In the previous example, we passed instances of the UI components (using the new keyword). The Navigator class will use these instances throughout the session, so the state of each view is maintained even after navigating away from a view. You can let the Navigator class create a new instance of the UI component each time the view is requested by using the overloaded addView(String, Class<? extends View>) method. Here's an example:

navigator.addView("view1", View1.class);

The UI components you can add to a Navigator must implement the View interface, as shown in the following class:

public class View1 extends Composite implements View { 
    public View1() { 
        setContent(new Label("View 1")); 
    } 
}

But let's get back to the discussion of authorization strategies. The Navigator class allows you to add a ViewChangeListener. We can use this listener to introduce authorization rules and secure UI components. For example:

public class AuthViewListener implements ViewChangeListener { 
 
    @Override 
    public boolean beforeViewChange(ViewChangeEvent event) { 
        if (AuthService.userCanAccess(event.getViewName())) { 
            return true; 
        } 
 
        return false; 
    } 
} 

The beforeViewChange method must return true to allow the view change and false to block it.