In an edge case where multiple browser tabs to a ZK web application are opened simultaneously it may occur, that each several browser tabs initialize a new ZK (SimpleSession). Since only one of these sessions can be stored in the HttpSession, some browser tabs lose their desktop, resulting in "timeout errors".

see: https://github.com/zkoss/zk/blob/master/zk/src/org/zkoss/zk/ui/sys/SessionsCtrl.java#L165-L166

In case SessionCtrl.newSession() is called by concurrent requests both new SimpleSession objects are "put" into the SessionCache while only the last object "survives".

A solution would be to synchronize on the native Session object before creating a newSession

e.g. here (and in DHtmlLayoutPortlet)
https://github.com/zkoss/zk/blob/master/zk/src/org/zkoss/zk/ui/http/WebManager.java#L442-L443