Two levels of coverage
See this Roland Krรผger publication on Vaadin 7 coverage with VaadinSession and UI . It includes a comparison with Vaadin 6. A good article, except that the discussion of manual locking is outdated with Vaadin 7.1 (see my comment on this page and see my answer to a similar question).
Understand that although the bulk of Vaadin 6 and Vaadin 7 are the same or the same, on this subject 6 and 7 are completely different, with different architectures and different classes.
Note that we are discussing VaadinSession , not HTTP or a servlet session . VaadinSession wraps or contains a Servlet session, so we donโt need to deal with the Servlet level.
This VaadinSession represents a single user working session. The user has one or more open windows / tabs ( UI instances).

This diagram above is a little simplified. Here is more detailed.

Multiple windows
Vaadin 7 supports multiple browser windows / tabs open in a single Vaadin application. This is a major architectural change from Vaadin 6.
The contents of each browser window / tab is an instance of your UI subclass. All of these instances belong to the same VaadinSession . If the user clicks on the reload function in the browser tab / tab, the UI instance is destroyed and a new instance is created. But VaadinSession suffers. Adding @PreserveOnRefresh annotation modifies this behavior to keep the same user interface instance, but this is not relevant.
The fact is that the Vaadin 7 has two levels of visibility:
VaadinSession (all your application)UI (each browser window / tab).
You might want to save data at any level. For example, user login / authentication information should go to VaadinSession.
Entering UI Status
To save data in the user interface, add fields or collections to your UI subclass. Simple and straightforward.
Enabling VaadinSession
To save data to VaadinSession, call setAttribute and getAttribute . You will have to give results. Simple except for one catch: thread safety.
streaming security
You can manually lock the lock to protect VaadinSession at the same time. But Vaadin will provide this protection against flows if you follow documented rules.
Main theme
If you change VaadinSession from the normal main UI thread, no problem. Most of what you do in Vaadin from the main thread already affects the VaadinSession object. This is where your application lives. Thus, thread-safe locking is already automatically provided by Vaadin.
Other topics
If you use VaadinSession from another thread, make your call in Runnable , go to the access method on either the UI or VaadinSession. If you are using any interface layout or widgets in addition to the session, call the access method on the user interface. If this affects only the session and not the user interface, pass your Runnable access method to VaadinSession.
Third Coverage: Expanded Application Coverage
FYI, you can use a wider reach. If you have global data or objects for sharing applications in all user sessions, you can access the ServletContext object. โContextโ means the world of your web application that your web application can access. Your Vaadin application has a single ServletContext object automatically created by your Servlet container. Call a couple of methods, getAttribute and setAttribute , to save whatever Object you have.
For more information, see this question and answer, How to access ServletContext from a Vaadin 7 application? .
To summarize in the text (and the diagram below): a Servlet container, such as Tomcat or Jetty, can run one or more Vaadin web applications. Each web application has a single ServletContext object, which is automatically controlled by the container, where the get/setAttribute can store any objects of your choice. Each Vaadin web application has one VaadinSession object for each current user session. Each VaadinSession object contains one or more instances of a subclass of UI representing the content viewed in a window / tab of web browsers (or in the portlet viewing area). Each instance of a subclass of UI can have any number of member variables, for example, any POJO .

Tip. Your Runnable can use the new shorter lambda syntax in Java 8 if you want. NetBeans 8 will even suggest that.