I use these settings (related to forum post Inactivity timeout )
The settings are:
server.servlet.session.timeout=30m
vaadin.servlet.close-idle-sessions=true
vaadin.heartbeatInterval=-1
The timeout seems to be working fine. My problem is that the user is taken back to the login screen where the Vaadin scripts will continually send requests to the server because the user does not close the browser.
Part of the reason for the invalid key could be the server was restarted and now the client and server are out of sync. But again, I think the root of the problem is the chatty login page. If the user could be taken to a static HTML page instead then there would be no more requests made after logout.