Inherit Spring Security Context in Child Threads - Spring Forward
By default, Spring Security context is bound to ThreadLocal, which may catch you by surprise in some cases involving spawned threads.
So I setup my security infrastructure to authenticate users, populate their details from database, grant them authorities, I configure AccessDecisionManager and put @Secured annotations on my business methods to assert those authorities, etc. It all works well until my business code evolves to include asynchronous invocations. Then I find myself wondering: why am I getting AuthenticationCredentialsNotFoundException in places where the user is obviously authenticated?
Turns out that when a new thread is started it knows nothing about the security context of its parent thread. So if AccessDecisionManager gets called (e.g. if a @Secured method is invoked) from within the child thread, you get a security exception.
Read full article from Inherit Spring Security Context in Child Threads - Spring Forward
No comments:
Post a Comment