I have a spring boot application that uses the MVC servlet mechanism. Few APIs use Mono and Flux: Reactive endpoints. The Spring Security used in the project is Servlet-based. The Security Context is set in the BearerTokenAuthenticationFilter.

Problem:
The Security context works fine when using the Servlet-based controllers. But regarding controllers that return a reactive Publisher, the Security context is null.

I have changed the strategy of the context.

@PostConstruct
public void init() {
    SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL);
}

This somewhat solved the problem. But still, there is an issue with maintaining security context. It has a null value sometimes.

I cannot change the security to reactive as some of the legacy libraries still depend on servlet configurations.

So is there a way to maintain the Security Context without passing it to each method ?