How to manage single active user sessions (SSO context) in a clustered Vaadin 24

Elizaveta.2 · November 10, 2025, 4:31pm

Hi everyone,

I’m running into some architectural issues with session management in a Vaadin 24 application deployed across multiple pods in Kubernetes.

My case - each user must have only one active session at a time, in the context of SSO. If a user logs in from a different browser or device, the previous session should be invalidated.

I tried to implement this using Spring Session with Redis, which normally works well for stateless Spring Boot apps - but the login page reloads in a loop - The login page itself never loads - it keeps redirecting to login?error=session_expired.
It seems that Vaadin tries to initialize a VaadinSession for the login view, but Spring Session (backed by Redis) immediately treats the HTTP session as invalid or expired.
As a result, the AnonymousAuthenticationFilter takes over, Vaadin detects a missing session, and redirects back to the login URL before the view can render.
This creates a continuous redirect loop even before authentication actually starts.

With basic authentication, everything works correctly - the issue appears only with SSO.

Has anyone successfully implemented centralized session management (e.g., backed by Redis or another store) with Vaadin 24 + Spring Security + SSO?
What would be the recommended approach in 2025 to enforce “only one active session per user” across multiple Vaadin nodes?

Any examples, best practices, or guidance from the Vaadin team would be greatly appreciated.

Thanks in advance!

Tatu2 · November 10, 2025, 5:30pm

This (aka session concurrency) can be enforced with Spring Security and Vaadin does not to be involved. I have an example config here:

gist.github.com

https://gist.github.com/TatuLund/3fbb70e7f91aa04f67a3f212c20fa039

SecurityConfiguration.java

package org.vaadin.example;

import org.springframework.boot.web.servlet.ServletListenerRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.session.SessionRegistry;
import org.springframework.security.core.session.SessionRegistryImpl;

This file has been truncated. show original

I think with Spring Boot 3.5 API may have changed a little from earlier Spring Boot 3 versions.

Tatu2 · November 10, 2025, 5:32pm

Spring Session is not the right tool to handle session concurrency. Furthermore, Spring Session does not work with Vaadin at all.