While reading spring security docs, i have a question but i can’t find answer.
In spring security docs, they said
We start by creating an empty SecurityContext. You should create a new SecurityContext instance instead of using SecurityContextHolder.getContext().setAuthentication(authentication) to avoid race conditions across multiple threads.
i can’t understand why race condition can be happened.
I thought race condition can occurred when instance can be shared.
But securityContext is managed as threadlocal, so i think it can’t be shared.
My question is
- how race condition can occurred in SecurityContextHolder due to SecurityContext
- ThreadLocal instance can be shared?
New contributor
Dev is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1