What Is Securitycontext As Well As Securitycontextholder Inward Saltation Security?

The SecurityContext and SecurityContextHolder are 2 key classes of Spring Security. The SecurityContext is used to shop the details of the currently authenticated user, likewise known every bit a principle. So, if y'all cause got to acquire the username or whatsoever other user details, y'all ask to acquire this SecurityContext first. The SecurityContextHolder is a helper class, which render access to the safety context. By default, it uses a ThreadLocal object to shop safety context, which agency that the safety context is e'er available to methods inwards the same thread of execution, fifty-fifty if y'all don't travel yesteryear the SecurityContext object around. Don't worry near the ThreadLocal retentivity leak inwards spider web application though, Spring Security takes attention of cleaning ThreadLocal.

Btw, that's non the only way a SecurityContextHolder tin shop electrical flow SecurityContext, it tin hold upward configured amongst a strategy on startup to specify how y'all would the context to hold upward stored. For example, y'all tin utilisation SecurityContextHolder.MODE_GLOBAL strategy for a standalone application.

The key affair to larn is that how practice y'all acquire the SecurityContext from the SecurityContextHolder? as well as so retrieving electrical flow user details from that? For example, if y'all desire to know the username of the electrical flow logged inwards user so how practice y'all acquire that inwards Spring security?

In club to acquire the electrical flow username, y'all showtime ask a SecurityContext, which is obtained from SecurityContextHolder. This SecurityContext dice along the user details inwards an Authentication object, which tin hold upward obtained yesteryear calling getAuthentication() method.

Once y'all got the Authentication object, y'all tin either cast into UserDetails or utilisation it every bit it is. The UserDetails object is the i Spring Security uses to dice along user-related information.

How to acquire the electrical flow logged-in Username inwards Spring Security

Here is the code to acquire the safety context inwards Spring security as well as obtain the advert of the currently logged inwards user:

Object brain = SecurityContextHolder.getContext().getAuthentication().getPrincipal();  if (principal instanceof UserDetails) {   String username = ((UserDetails)principal).getUsername(); } else {   String username = principal.toString(); }

The object returned yesteryear getContext() is an illustration of the SecurityContext interface. This is the object that is stored inwards a thread-local storage.

The getPrincipal() method usually render UserDetails object inwards Spring Security, which contains all the details of currently logged inwards user. Btw, if y'all are simply starting amongst Spring safety as well as non familiar amongst these concepts so Spring as well as dependency injection. So if y'all ever ask to know electrical flow logged-in user details e.g. inwards Spring MVC controller, I propose y'all declare a dependency as well as allow the Spring render y'all the Principal object, rather y'all querying for them as well as practice a tightly coupled system.


Here is an illustration of that

import java.security.Principal; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.ResponseBody;  @Controller public class MVCController {    @RequestMapping(value = "/username", method = RequestMethod.GET)   @ResponseBody   public String currentUserName(Principal principal) {      return principal.getName();   }  }

Alternatively, y'all tin likewise inquire for Authentication object instead of a Principal object every bit shown below:

import org.springframework.security.core.Authentication; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.ResponseBody;  @Controller public class SpringMVCController {    @RequestMapping(value = "/username", method = RequestMethod.GET)   @ResponseBody   public String currentUserName(Authentication authentication) {      return authentication.getName();   } }

If y'all desire to know to a greater extent than ways, y'all tin likewise meet my post service near 3 ways to acquire the electrical flow username inwards Spring Security, where I cause got discussed a yoke of to a greater extent than ways to retrieve the electrical flow username inwards Spring MVC controller.

That's all near what is safety context inwards Spring security as well as how y'all tin obtain a SecurityContext from SecurityContextHolder class. These are unopen to of the key classes, therefore y'all must hold upward familiar amongst them.

The storage utilisation i.e. SecurityContext is stored inwards ThreadLocal is optional, but it's likewise proficient to know the detail. Just remember, if y'all ever ask user details e.g. username etc, y'all meliorate inquire for Principal or Authentication object inwards Spring MVC controller, rather than using SecurityContextHolder to obtain them.

Other Spring Security Articles as well as Resources you may like:
20 Spring REST Interview Questions amongst Answers

Learn Spring Security four Basic hands-on
Difference between @RestController as well as @Controller inwards Spring MVC?

Spring Framework 5: Beginner to Guru

Difference between @RequestParam as well as @PathVaraible inwards Spring?

3 Online Courses to larn Spring Security better
Difference between @Service, @Component, as well as @Controller inwards Spring?
5 Courses to larn Spring Core, Spring MVC, as well as Spring Boot

How to enable Http Basic Authentication inwards Spring Security App?
Spring Security Certification Class yesteryear Eugen Paraschiv

Thanks for reading this article so far. If y'all similar this Spring Security tutorial so delight portion amongst your friends as well as colleagues. If y'all cause got whatsoever questions or feedback so delight drib a note. 

Bagikan Artikel ini