@Component
@Scope(value="session", proxyMode=ScopedProxyMode.TARGET_CLASS)
public class CurrentUser {

    private boolean isUserLoggedIn;

    @Autowired
    public CurrentUser(UserService users) {
        isUserLoggedIn = users.isUserLoggedIn();
    }

    public boolean isLoggedIn() {
        return isUserLoggedIn;
    }
}

@Service
public class UserService {

    public boolean isUserLoggedIn() {
        return isAuthenticated(getAuth());
    }

    private boolean isAuthenticated(Authentication auth) {
        return auth.isAuthenticated() &&
                auth.getPrincipal() instanceof org.springframework.security.core.userdetails.User;
    }

    private Authentication getAuth() {
        return SecurityContextHolder.getContext().getAuthentication();
    }
}

@RequestMapping(value={"tasks"})
@PreAuthorize("hasRole('ROLE_USER')")
@Controller
public class TaskController {

    private final CurrentUser currentTaskUser;

    @Autowired
    public TaskController(CurrentUser currentTaskUser) {
        this.currentTaskUser = currentTaskUser;
    }

    @ModelAttribute
    public boolean isTaskUserLoggedIn() {
        System.out.println("TaskController isLoggedIn: " + currentTaskUser.isLoggedIn());
        return false;
    }
}

@ControllerAdvice
public class ControllerSettings {

    private final CurrentUser currentUser;

    @Autowired
    public ControllerSettings(CurrentUser currentUser) {
        this.currentUser = currentUser;
    }

    @ModelAttribute
    public boolean isUserLoggedIn() {
        /* the following line creates the problem */
        System.out.println("ControllerSettings isLoggedIn: " + currentUser.isLoggedIn());
        return false;
    }
}

TaskController isLoggedIn: true

ControllerSettings isLoggedIn: false
TaskController isLoggedIn: false