Custom portal REST API failure after platform upgrade

Support
#1

Our project has custom portal REST API at /app-portal/rest/v1.0/** end point. It works with CUBA Platform 6.10.9 but after upgrade to 6.10.10(11) any request failures with error “Invalid access token” and HTTP status 401.
Client gets OAuth token by request to /app/rest/v2/oauth/token.
These are messages from server log with platform 6.10.9 after rest login:

01:06:40.276 INFO  c.h.c.s.a.AuthenticationManagerBean     - Logged in: fb440fd9-5100-3267-f9b9-ee83d9469ab8 [9265540714]
01:06:41.481 INFO  c.h.r.auth.ClientProxyTokenStore        - REST API access token stored: [9265540714] ***-7018a5642eaa

and with 6.10.11:

01:42:12.406 INFO  c.h.c.s.a.AuthenticationManagerBean     - Logged in: 24668c0b-ce4d-a14c-da21-27ff4adb7735 [9265540714]
01:42:16.460 INFO  c.h.c.s.a.AuthenticationManagerBean     - Logged in: 78e5c771-47cf-bc42-2e69-9a35d391ed28 [9265540714]
01:42:16.924 WARN  c.v.v.listener.LoginEventListener       - Success removing: session for Token: 9242ec28-68ad-4df3-9f26-9c786317e72d, user: 9265540714 {35955b7e-8831-27d6-b0e5-b10f68145fbe}, REST API (localhost:8080/vol) Apache-HttpClient/4.1.1 (java 1.5)
01:42:17.419 INFO  c.h.r.auth.ClientProxyTokenStore        - REST API access token stored: [9265540714] ***-9c786317e72d

I see some differences here.
Yet there is an error message in app-core application deploying log (if it’ll help):

01:41:22.394 ERROR c.v.v.core.crm.CRMHTTPConnectionImpl    - cant authenticate in CRM 404 Not Found

Were there any changes in REST API mechanism and what should I do to make it work?

#3

I see log messages from the classes of your project: c.v.v.listener.LoginEventListener, c.v.v.core.crm.CRMHTTPConnectionImpl. It’s hard to say where the cause of the error is: in your project or in CUBA. Can you reproduce the problem on a demo project? If so then attach it here please - it’ll help us to understand and to solve the problem.
A list of fixed issues can be found in the release notes: CUBA Platform and Studio Release Notes

#5

Error c.v.v.core.crm.CRMHTTPConnectionImpl is project specific, forget it. But message c.v.v.listener.LoginEventListener says that extra REST session had been terminated, this is our project feature. And where the extra session appears from? Two previous log messages say that the platform authentication mechanism somehow creates 2 sessions instead of 1 when client send login request. In 6.10.9 was only one session.

#6

Okay, now I see it. Looks like a bug. The issue: REST API: Login is performed twice when a new access token is obtained · Issue #2277 · cuba-platform/cuba · GitHub