Spring Security and @Async (Authenticated Users mixed up)

Question

I asynchronously invoke method with Spring, using @Async.This method invokes other method annotated with @PreAuthorize, Spring Security Annotation. To make authorization works I have to set SecurityContextHolder mode to MODE_INHERITABLETHREADLOCAL, so that authentication info is passed to the asynchronous call. Everything works fine so far.

However when I logout and login as a different user, in asynchronous method SecurityContextHolder stores authentication info of the old user, that has bee logged out. It causes of course unwanted AccessDenied exception. There is no such problem with synchronous calls.

I have defined <task:executor id="executors" pool-size="10"/>, so may it be a problem that once thread in executors pool has been initialized it will not override authentication information?

Answer 1

I guess MODE_INHERITABLETHREADLOCAL doesn't work correctly with thread pool.

As a possible solution you can try to subclass ThreadPoolTaskExecutor and override its methods to propagate SecurityContext manually, and then declare that executor instead of <task:executor>, something like this:

public void execute(final Runnable r) {     final Authentication a = SecurityContextHolder.getContext().getAuthentication();      super.execute(new Runnable() {         public void run() {             try {                 SecurityContext ctx = SecurityContextHolder.createEmptyContext();                 ctx.setAuthentication(a);                 SecurityContextHolder.setContext(ctx);                 r.run();             } finally {                 SecurityContextHolder.clearContext();             }         }     }); }