Logout - invalidate session causes Session Expired when @Push is enabled

Vaadin 6 / 7 / 8
1

Hi guys,

I’d like to ask you for help, please. I just got stuck and I don’t know how to proceed, so I’m gonna try my luck here…

I’m making a simple Spring Boot 2.0.0/Vaadin 8.5.2 application and was trying to implement a very simple security based on this example:
https://examples.javacodegeeks.com/enterprise-java/vaadin/vaadin-spring-security-example/

I got the login process to work, however I’m having troubles with logout, apparently because of the @Push functionality my application is using (and it’s quite essential, so I cannot get rid of it).

When trying to proceed with the logout and performing the invalidate() method, the browser shows first the “Session Expired” notification on the top. I first need to click it (or press Escape) in order to proceed back to the login page, which is of course not acceptable in such situation for an end user. I found this forum thread (https://github.com/vaadin/framework/issues/4255), however disabling the PushMode is not helping as well, still the same problem (however I’m not even sure, if such an old thread still applies to my Vaadin version).

Here’s the code snippet of what the logout procedure is doing:

  private void logout() {
    UI.getCurrent().getPushConfiguration().setPushMode(PushMode.DISABLED);
    VaadinService.getCurrentRequest().getWrappedSession().invalidate();
    new SecurityContextLogoutHandler().logout(
        ((com.vaadin.server.VaadinServletRequest) VaadinService.getCurrentRequest()).getHttpServletRequest(), null,
        null);
    Page.getCurrent().setLocation("/");
  }

On the other hand I tried to remove the @Push annotation and then it worked properly, so I’m quite sure it’s connected with it.

Does anyone PLEASE have an idea on how to proceed? What am I doing wrong? Any help/tips/tricks/workarounds appreciated…

Thank you very much!

2

I guess I solved it. Added the Transport.WEBSOCKET_XHR parameter to the Push annotation. Resulting code:

@Push(transport = Transport.WEBSOCKET_XHR)

  private void logout() {
    VaadinService.getCurrentRequest().getWrappedSession().invalidate();
    new SecurityContextLogoutHandler().logout(
        ((com.vaadin.server.VaadinServletRequest) VaadinService.getCurrentRequest()).getHttpServletRequest(), null,
        null);
    Page.getCurrent().setLocation("/");
  }