Does BeforeEnterEvent execute before target view instantiation?

Direct answer

Yes. In Vaadin Flow 14 and later, the router dispatches BeforeEnterEvent before the view provider creates an instance of the destination view class.

Navigation lifecycle order

The default router sequence is:

1. Router resolves the navigation target.
2. BeforeEnterEvent is fired to registered BeforeEnterListener instances.
3. If a listener calls event.forwardTo() or event.rerouteTo(), navigation is aborted and the original view constructor never runs.
4. If no listener reroutes, the view provider instantiates the view.
5. AfterEnterEvent is then fired.

What this means for access checks

Because the event precedes instantiation, constructor logic in the target view does not execute for unauthorized users when a listener reroutes. This makes the event suitable for guarding expensive view setup, though field injection and initialization still occur only after the view is created.

Does @PermitAll change this?

No. Spring Security annotations such as @PermitAll operate outside the Vaadin router lifecycle. They affect authorization decisions in the security layer, but they do not move view instantiation earlier in the Vaadin navigation sequence. The router still fires BeforeEnterEvent before creating the view.

Caveat: custom view providers

The order described above applies to the default ViewProvider implementations. If you supply a custom provider that instantiates the view before the event is dispatched, the observed order can differ. With standard configuration, however, the event always comes first.

Quick verification

You can confirm the order with a temporary log in the view constructor and a global listener:

@Route("protected")
public class ProtectedView extends VerticalLayout {
    public ProtectedView() {
        System.out.println("View constructed");
    }
}

public class AuthListener implements BeforeEnterListener {
    @Override
    public void beforeEnter(BeforeEnterEvent event) {
        System.out.println("BeforeEnter received");
        if (!isAuthenticated()) {
            event.rerouteTo("login");
        }
    }
}

When navigation proceeds, "BeforeEnter received" prints before "View constructed". When the listener reroutes, the constructor log is absent.