Snippet

Propagating Security Context Across Asynchronous Threads with DelegatingSecurityContextAsyncTaskExecutor

By default, Spring Security stores authentication tokens in a `ThreadLocal` strategy (`MODE_THREADLOCAL`). As a consequence, spawned background threads invoked via `@Async` lose access to the current `SecurityContext`. Wrapping the task executor in a `DelegatingSecurityContextAsyncTaskExecutor` ensures security context snapshots are transparently transferred to the worker threads before task execution and cleared afterward.

snippet.java

java

@Configuration
@EnableAsync
public class AsyncSecurityConfig {
 
    @Bean(name = "securityAwareExecutor")
    public AsyncTaskExecutor securityAwareExecutor() {
        ThreadPoolTaskExecutor delegate = new ThreadPoolTaskExecutor();
        delegate.setCorePoolSize(4);
        delegate.setMaxPoolSize(16);
        delegate.setQueueCapacity(100);
        delegate.setThreadNamePrefix("secure-async-");
        delegate.initialize();
        return new DelegatingSecurityContextAsyncTaskExecutor(delegate);
    }
}

spring

Breakdown

@EnableAsync

Enables Spring's asynchronous method execution capabilities across the application context.

ThreadPoolTaskExecutor delegate = new ThreadPoolTaskExecutor();

Configures the underlying standard Java thread pool with pool sizing and queue capacity.

return new DelegatingSecurityContextAsyncTaskExecutor(delegate);

Decorates the executor so that submitted Runnables and Callables copy the caller's SecurityContext into the worker thread.

Previous snippet Next snippet

More Intermediate Java exercises →

Propagating Security Context Across Asynchronous Threads with DelegatingSecurityContextAsyncTaskExecutor

Related