Vaadin + Spring Boot = Session expired Problems

Hello,

im using Vaadin 7.75 with Spring Boot and Spring Security.
I have a strange behaviour in my app.
When there is a long running UI Task (e.g. Uploading a large file) the session gets immediatly closed and i get the “Session expired” Notification.

This also happenn randomly when switching views. I’ve tried different configurations of heartbeat + session timeout but i think it isnt related to that. Session is closed in 10 seconds if i’m clicking the right buttons. Server log shows no errors, i can only see, that the ui is initialized on session timeout reload. Client log shows, that the application is closed and heartbeat interval is set to (-1)

Spring boot configuration:

#security
security.headers.frame=false
security.enable-csrf=false

#vaadin
vaadin.servlet.production-mode=false
vaadin.servlet.heartbeat-interval=300

#server
server.session.timeout=1800
server.port=8080

Case

Vaadin View -> Button -> new Model Popup Window with (EasyUpload) Upload Button.
Uploading large file -> session expired

Client Debug Log
(from Uploading 4.2MB File to app)
Another strange behaviour:
First Upload always fail because of an 410 server response, second upload succeed if the file is not to large.
If the file is too large (test with 4.2 mb file) the session timed out.

sStarting application ROOT-2521314
1169msUsing theme: valo
1171msVaadin application servlet version: 7.7.5
1186msSetting hearbeat interval to 300sec.
1195msJSON parsing took 0.935ms
1198msHandling message from server
1203ms* Handling resources from server
1206ms* Handling type inheritance map from server
1210msHandling type mappings from server
1220msHandling resource dependencies
1222ms* Handling type mappings from server completed: 12 ms
1223ms* Handling meta information
1225ms* Creating connectors (if needed)
1282msUsing Translate3DPosition for position
1339ms* Updating connector states
1378ms* Handling locales
1381ms* Updating connector hierarchy
1389ms* Sending hierarchy change events
1450ms* Running @DelegateToWidget
1453ms* Sending state change events
1774ms* Passing UIDL to Vaadin 6 style connectors
1803ms* Performing server to client RPC calls
1807msServer to client RPC call: 35:com.vaadin.shared.data.DataProviderRpc.resetDataAndSize([426]
)
1910msServer to client RPC call: 35:com.vaadin.shared.data.DataProviderRpc.setRowData([0, [object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
,[object Object]
])
1972ms* Unregistered 0 connectors
1973mshandleUIDLMessage: 749 ms
1978msStarting layout phase
2028msMeasured 10 non connector elements
2066msPass 1 measured 25 elements, fired 0 listeners and did 2 layouts.
2071msPass 2 measured 10 elements, fired 0 listeners and did 1 layouts.
2072msDid overflow fix for 1 elements
2080msPass 3 measured 20 elements, fired 0 listeners and did 1 layouts.
2084msDid overflow fix for 1 elements
2088msPass 4 measured 1 elements, fired 0 listeners and did 0 layouts.
2089msNo more changes in pass 5
2090msTotal layout phase time: 108ms
2091ms* Dumping state changes to the console
2092msUIDL: undefined
2169msFirst response processed 3680 ms after fetchStart
2169msProcessing time was 970ms
2171msReferenced paintables: 56
2243msStarting layout phase
2247msMeasured 10 non connector elements
2254msPass 1 measured 6 elements, fired 0 listeners and did 1 layouts.
2258msPass 2 measured 2 elements, fired 0 listeners and did 0 layouts.
2259msNo more changes in pass 3
2260msTotal layout phase time: 16ms
3925msRPC invocations to be sent to the server:
3926ms   0 (class com.vaadin.client.ui.ui.UIConnector) :
3928ms      com.vaadin.shared.ui.ui.UIServerRpc.resize([659, 1438, 1438, 659]
)
3929ms   25 (class com.vaadin.client.ui.button.ButtonConnector) :
3931ms      com.vaadin.shared.ui.button.ButtonServerRpc.click([LEFT,1205,208,false,false,false,false,1,33,18]
)
3934msSending xhr message to server: {"csrfToken":"a58ceb50-b07f-4afd-9526-d976cd738f7c","rpc":[["0","com.vaadin.shared.ui.ui.UIServerRpc","resize",[659,1438,1438,659]
],["25","com.vaadin.shared.ui.button.ButtonServerRpc","click",[{"altKey":false,"button":"LEFT","clientX":1205,"clientY":208,"ctrlKey":false,"metaKey":false,"relativeX":33,"relativeY":18,"shiftKey":false,"type":1}]
]],"syncId":0,"clientId":0,"wsver":"7.7.5"}
4052msServer visit took 117.55ms
4053msJSON parsing took 0.195ms
4054msReceived xhr message: for(;;);[{"syncId": 1, "clientId": 1, "changes" : [["change",{"pid":"0"},["0",{"id":"0","location":"http:\/\/devnet.fireflow.de:8086\/?debug#!editor\/driver"}]
],["change",{"pid":"58"},["45",{"id":"58","v":{"action":""}},["actions",{},["action",{"key":"1","kc":27,"mk":[]
}]]]],["change",{"pid":"68"},["46",{"id":"68"}]
],["change",{"pid":"64"},["47",{"id":"64","tabindex":0,"state":false,"buttoncaption":"CSV auswählen","nextid":0,"v":{"action":"app:\/\/APP\/UPLOAD\/0\/64\/action\/03d6a70d-1436-4814-97ad-707601c43201"}}]
]], "state":{"58":{"modal":true,"centered":true,"tabIndex":-1,"caption":"Upload"},"59":{"spacing":true,"childData":{"60":{"alignmentBitmask":5,"expandRatio":0}},"marginsBitmask":15,"width":"100.0%"},"60":{"spacing":true,"childData":{"61":{"alignmentBitmask":5,"expandRatio":0},"62":{"alignmentBitmask":5,"expandRatio":0},"68":{"alignmentBitmask":5,"expandRatio":0},"69":{"alignmentBitmask":10,"expandRatio":0}},"marginsBitmask":15,"width":"100.0%"},"61":{"text":"Wähle eine Datei aus und lade sie hoch. Während der Verarbeitung darf das Fenster nicht geschlossen werden","width":"100.0%"},"62":{"spacing":true,"childData":{"63":{"alignmentBitmask":5,"expandRatio":0}},"width":"100.0%"},"63":{"width":"200.0px","styles":["v-component-group"]
},"64":{"immediate":true},"65":{"accept":"text/csv"},"68":{"rows":10,"text":"","width":"100.0%","caption":"Ausgabe","enabled":false},"69":{"caption":"Schließen","styles":["primary"]
}}, "types":{"0":"0","58":"45","59":"48","60":"48","61":"7","62":"13","63":"49","64":"47","65":"50","68":"46","69":"11"}, "hierarchy":{"0":["1","58"]
,"58":["59"]
,"59":["60"]
,"60":["61","62","68","69"]
,"62":["63"]
,"63":["64"]
,"64":["65"]
}, "rpc" : [], "meta" : {}, "resources" : {}, "typeMappings" : { "org.vaadin.easyuploads.UploadField" : 51 , "org.vaadin.viritin.layouts.MVerticalLayout" : 48 , "de.fireflow.bst.ui.component.KModalWindow" : 52 , "org.vaadin.viritin.fields.MTextArea" : 46 , "de.fireflow.bst.ui.component.CSVUploadWindow" : 45 , "com.vaadin.ui.TextArea" : 53 , "com.vaadin.ui.Window" : 54 , "de.fireflow.bst.ui.component.KUploadField" : 49 , "com.vaadin.ui.Upload" : 47 , "org.vaadin.easyuploads.Html5FileInputSettings" : 50 }, "typeInheritanceMap" : { "20" : 42 , "18" : 25 , "7" : 20 , "1" : 34 , "51" : 18 , "25" : 44 , "26" : 42 , "13" : 9 , "48" : 17 , "32" : 40 , "34" : 42 , "52" : 54 , "16" : 26 , "35" : 34 , "46" : 53 , "36" : 31 , "45" : 52 , "53" : 32 , "17" : 39 , "0" : 35 , "54" : 1 , "39" : 25 , "49" : 51 , "40" : 42 , "47" : 42 , "50" : 36 , "42" : 31 , "9" : 39 , "11" : 16 , "44" : 42 }, "timings":[1275, 1275]
}]
4055msHandling message from server
4056ms* Handling resources from server
4056ms* Handling type inheritance map from server
4061msHandling type mappings from server
4062msHandling resource dependencies
4062ms* Handling meta information
4063ms* Creating connectors (if needed)
4075ms* Updating connector states
4081ms* Handling locales
4088ms* Updating connector hierarchy
4090ms* Sending hierarchy change events
4113ms* Running @DelegateToWidget
4114ms* Sending state change events
4137msstatechange
4138msRegistering true
4142ms* Passing UIDL to Vaadin 6 style connectors
4151ms* Performing server to client RPC calls
4152ms* Unregistered 0 connectors
4153mshandleUIDLMessage: 90 ms
4154msStarting layout phase
4168msMeasured 14 non connector elements
4189msPass 1 measured 27 elements, fired 0 listeners and did 1 layouts.
4217msPass 2 measured 20 elements, fired 0 listeners and did 1 layouts.
4223msPass 3 measured 7 elements, fired 0 listeners and did 1 layouts.
4225msDid overflow fix for 4 elements
4229msPass 4 measured 6 elements, fired 0 listeners and did 0 layouts.
4230msNo more changes in pass 5
4233msTotal layout phase time: 78ms
4233ms* Dumping state changes to the console
4233msUIDL: undefined
4239msProcessing time was 184ms
4240msReferenced paintables: 66
10384msSubmit
10385msRPC invocations to be sent to the server:
10385ms   58 (class com.vaadin.client.ui.window.WindowConnector) :
10386ms      v.v(positionx : 274)
10386ms      v.v(positiony : 66)
10388msSending xhr message to server: {"csrfToken":"a58ceb50-b07f-4afd-9526-d976cd738f7c","rpc":[["58","v","v",["positionx",["i",274]
]],["58","v","v",["positiony",["i",66]
]]],"syncId":1,"clientId":1}
10433msServer visit took 44.62ms
10435msJSON parsing took 0.075ms
10435msReceived xhr message: for(;;);[{"syncId": 2, "clientId": 2, "changes" : [["change",{"pid":"58"},["45",{"id":"58","v":{"action":""}},["actions",{},["action",{"key":"1","kc":27,"mk":[]
}]]]]], "state":{"58":{"centered":false,"positionX":274,"positionY":66}}, "types":{"58":"45"}, "hierarchy":{"58":["59"]
}, "rpc" : [], "meta" : {}, "resources" : {}, "timings":[1360, 85]
}]
10438msHandling message from server
10440ms* Handling resources from server
10440ms* Handling type inheritance map from server
10441msHandling type mappings from server
10443msHandling resource dependencies
10446ms* Handling meta information
10447ms* Creating connectors (if needed)
10447ms* Updating connector states
10449ms* Handling locales
10449ms* Updating connector hierarchy
10450ms* Running @DelegateToWidget
10451ms* Sending state change events
10460ms* Passing UIDL to Vaadin 6 style connectors
10461ms* Performing server to client RPC calls
10463ms* Unregistered 0 connectors
10464mshandleUIDLMessage: 17 ms
10465msStarting layout phase
10470msMeasured 14 non connector elements
10478msPass 1 measured 24 elements, fired 0 listeners and did 0 layouts.
10479msNo more changes in pass 2
10480msTotal layout phase time: 14ms
10480ms* Dumping state changes to the console
10481msUIDL: undefined
10482msProcessing time was 45ms
10483msReferenced paintables: 66
11129msVUpload:Submit complete
11133msRPC invocations to be sent to the server:
11135ms   64 (class com.vaadin.client.ui.upload.UploadConnector) :
11136ms      com.vaadin.shared.ui.upload.UploadServerRpc.poll([])
11137msSending xhr message to server: {"csrfToken":"a58ceb50-b07f-4afd-9526-d976cd738f7c","rpc":[["64","com.vaadin.shared.ui.upload.UploadServerRpc","poll",[]
]],"syncId":2,"clientId":2}
11837msServer visit took 700.445ms
11841msJSON parsing took 0.03ms
11847msReceived xhr message: for(;;);[{"syncId": 3, "clientId": 3, "changes" : []
, "state":{}, "types":{}, "hierarchy":{}, "rpc" : [], "meta" : {}, "resources" : {}, "timings":[1366, 6]
}]
11847msHandling message from server
11847ms* Handling resources from server
11848ms* Handling type inheritance map from server
11849msHandling type mappings from server
11852msHandling resource dependencies
11855ms* Handling meta information
11855ms* Creating connectors (if needed)
11856ms* Updating connector states
11856ms* Handling locales
11858ms* Updating connector hierarchy
11859ms* Running @DelegateToWidget
11860ms* Sending state change events
11861ms* Passing UIDL to Vaadin 6 style connectors
11862ms* Performing server to client RPC calls
11863ms* Unregistered 0 connectors
11864mshandleUIDLMessage: 9 ms
11864ms* Dumping state changes to the console
11864msUIDL: undefined
11865msProcessing time was 18ms
11866msReferenced paintables: 66
48727msSubmit
49531msVisiting server to see if upload started event changed UI.
49533msRPC invocations to be sent to the server:
49535ms   64 (class com.vaadin.client.ui.upload.UploadConnector) :
49536ms      v.v(pollForStart : 0)
49539msSending xhr message to server: {"csrfToken":"a58ceb50-b07f-4afd-9526-d976cd738f7c","rpc":[["64","v","v",["pollForStart",["i",0]
]]],"syncId":3,"clientId":3}
49580msServer visit took 42.09ms
49581msJSON parsing took 0.055ms
49581msReceived xhr message: for(;;);[{"changes":{},"resources":{},"locales":{},"meta":{"appError":{"caption":"Session Expired","url":null,"message":"Take note of any unsaved data, and <u>click here</u> or press ESC key to continue.","details":null}},"syncId":-1}]

49582msResponse didn't contain a server id. Please verify that the server is up-to-date and that the response data has not been modified in transmission.
49583msHandling message from server
49584ms* Handling resources from server
49584ms* Handling type inheritance map from server
49585msHandling type mappings from server
49585msHandling resource dependencies
49587ms* Handling meta information
49589ms* Creating connectors (if needed)
49590ms* Updating connector states
49590ms* Handling locales
49591ms* Updating connector hierarchy
49591ms* Running @DelegateToWidget
49592ms* Sending state change events
49592ms* Passing UIDL to Vaadin 6 style connectors
49593ms* Unregistered 0 connectors
49594mshandleUIDLMessage: 5 ms
49594msStarting layout phase
49603msMeasured 14 non connector elements
49610msPass 1 measured 24 elements, fired 0 listeners and did 0 layouts.
49610msNo more changes in pass 2
49612msTotal layout phase time: 17ms
49612ms* Dumping state changes to the console
49613msUIDL: undefined
49622msSetting hearbeat interval to -1sec.
49622msProcessing time was 40ms
49623msReferenced paintables: 66
68465msVUpload:Submit complete
68467msTrying to invoke method on not yet started or stopped application
103271ms

Hope for your help.
If you need any further informations, please ask.

I’ve testet a bit more and there is definitly an issue with vaadin + spring security (spring boot).
Removing spring-security-starter from pom.xml and all is working fine.

i have disabled spring security csfr token and frame headers, is there something else todo?