Restore session from cookie (JWT)

This project is taken as a basis - Full Stack App

So, I have sush steps

  1. My JWT token is saved in cookies
  2. SecurityConfig
public class SecurityConfig extends WebSecurityConfigurerAdapter {

  protected void configure(HttpSecurity http) throws Exception {
        // Register our CustomRequestCache, that saves unauthorized access attempts, so
        // the user is redirected after login.
        .requestCache().requestCache(new CustomRequestCache())
        // Allow all flow internal requests.
        .mvcMatchers(PAGE_ROOT, PAGE_ROOT + PAGE_LOGIN_URL).permitAll()
        // Allow all requests by logged in users.

   * Allows access to static resources, bypassing Spring security.
  public void configure(WebSecurity web) {
        // Vaadin Flow static resources
        // the standard favicon URI
        // the robots exclusion standard
        // web application manifest
        // icons and images
        // (development mode) static resources
        // (development mode) webjars
        // (production mode) static resources
  1. InitListener
public class InitListener implements VaadinServiceInitListener {

  private final AuthService authService;

  public void serviceInit(ServiceInitEvent event) {
    final AtomicInteger sessionsCount = new AtomicInteger(0);
    final VaadinService vaadinService = event.getSource();
        sessionInitEvent -> {
"New Vaadin session created. Current count is: {}", sessionsCount.incrementAndGet());
"restoreSession - FINISH");
        sessionDestroyEvent ->"Vaadin session destroyed. Current count is {} ", sessionsCount.decrementAndGet()));

    event.getSource().addUIInitListener(uiEvent -> {
      UI ui = uiEvent.getUI();
      ui.add(new OfflineBanner());

   * Reroutes the user if she is not authorized to access the view.
   * @param event before navigation event with event details
  private void beforeEnter(BeforeEnterEvent event) {"beforeEnter - START");
    boolean accessGranted = SecurityUtils.isAccessGranted(event.getNavigationTarget());
    if (!accessGranted) {
      if (SecurityUtils.isUserLoggedIn()) {
      } else {

So my questions

  1. Sometimes I see two VaadinSessions. Why two sessions can start?
  2. SpringSecurtiy fulfills faster than I take a token and get the current user. How can this problem be solved?
2020-03-08 10:31:26.918  INFO 28930 --- [nio-8080-exec-1]
[/]       : Initializing Spring DispatcherServlet 'dispatcherServlet'
2020-03-08 10:31:26.918  INFO 28930 --- [nio-8080-exec-1]
 o.s.web.servlet.DispatcherServlet        : Initializing Servlet 'dispatcherServlet'
2020-03-08 10:31:26.923  INFO 28930 --- [nio-8080-exec-1]
 o.s.web.servlet.DispatcherServlet        : Completed initialization in 5 ms
2020-03-08 10:31:29.207  WARN 28930 --- [nio-8080-exec-2]
 c.v.f.s.DefaultDeploymentConfiguration   : 
Vaadin is running in DEBUG MODE.
In order to run your application in production mode and disable debug features, you should enable it by setting the servlet init parameter productionMode to true.
See for more information about the production mode.
2020-03-08 10:31:30.306  INFO 28930 --- [nio-8080-exec-2]
 c.vaadin.flow.spring.SpringInstantiator  : The number of beans implementing 'I18NProvider' is 0. Cannot use Spring beans for I18N, falling back to the default behavior
2020-03-08 10:31:30.306  INFO 28930 --- [nio-8080-exec-2]
 c.r.v.config.listener.InitListener   : New Vaadin session created. Current count is: 1
2020-03-08 10:31:30.307  INFO 28930 --- [nio-8080-exec-2]
 com.rednavis.vaadin.service.AuthService  : AccessCookies exists

On the first question. I found some information. So I’m not alone in this matter. But did not find a solution = (


But problems remain with the second question
For example user open http://localhost:8080/privateView
In class InitListener

public class InitListener implements VaadinServiceInitListener{}
  1. I get AccessToken from Cookie
  2. I send it to a third-party server to get the user
  3. Then set the user in SecurityContextHolder

But while actions 1-3
Spring Security checks that there is no authorized user does not allow me to this page. Redirect to LoginView