authentication - Is a SecurityContext shared between requests when using Spring Security? -

i'm seeing strange behaviour when using stateless token-based authentication on rest api written using spring boot.

the client includes jwt token each request, , custom filter i've written extends genericfilterbean adds authentication object based on claims in token security context using following :

securitycontextholder.getcontext().setauthentication(authentication); 

and clears context after processing request doing :

securitycontextholder.getcontext().setauthentication(null); 

however when simple app i've developed performs range of operations, see security context isn't being set correctly - it's null request has supplied token. filter being called correctly, setauthencation() being called, request fails authentication, , throws 403 denied.

if explicitly turn off http session management setting session creation policy stateless, behaviour stops.

any ideas happening here? security context being shared between threads dealing requests in way?

it seems context can shared, according official documentation here : http://docs.spring.io/spring-security/site/docs/3.1.x/reference/springsecurity-single.html

in application receives concurrent requests in single session, same securitycontext instance shared between threads. though threadlocal being used, same instance retrieved httpsession each thread. has implications if wish temporarily change context under thread running. if use securitycontextholder.getcontext(), , call setauthentication(anauthentication) on returned context object, authentication object change in concurrent threads share same securitycontext instance. can customize behaviour of securitycontextpersistencefilter create new securitycontext each request, preventing changes in 1 thread affecting another. alternatively can create new instance @ point temporarily change context. method securitycontextholder.createemptycontext() returns new context instance.