What is Spring Security's SecurityContext and how is it propagated? स्प्रिंग सिक्योरिटी का SecurityContext क्या है और यह कैसे प्रोपेगेट होता है?

The SecurityContext holds the current Authentication object, representing the currently authenticated user, their credentials, and granted authorities. It's stored in a SecurityContextHolder, which by default uses a ThreadLocal so the context is available anywhere within the same thread handling a request, without needing to pass the user explicitly through every method call.

Because it's thread-local by default, the context does not automatically propagate to new threads spawned for async processing (@Async, a new Thread, or a thread pool); propagating it requires either passing the Authentication explicitly or switching the holder strategy to MODE_INHERITABLETHREADLOCAL.

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
String username = auth.getName();
Collection<? extends GrantedAuthority> roles = auth.getAuthorities();