title: How to properly log authenticated user in AccessLog with WebFlux and Netty?
body: <p>Using Spring Boot 2.7.3 and Netty 1.0.22 I'm struggling with logging the authenticated user in netty's access logs. User has been properly authenticated with Spring Security (HTTP basic) but the access logs just show <code>-</code> (<code>AbstractAccessLogArgProvider.MISSING</code>).</p>
  <p>I cannot even extract it from the <code>ReactiveSecurityContextHolder</code> and set it manually within a <code>NettyServerCustomizer</code> without blocking because the <code>AccessLogFactory</code> interface is imperative and not reactive.</p>
  <p>Here's my Netty configuration :</p>
  <pre><code>@Component
  public class MyNettyCustomizer implements NettyServerCustomizer {
      @Override
      public HttpServer apply(HttpServer httpServer) {
          return httpServer.accessLog(true);
      }
  }
  </code></pre>
  <p>and the resulting access log :</p>
  <pre><code>2022-08-30 09:50:45.443  INFO 12928 --- [ctor-http-nio-3] reactor.netty.http.server.AccessLog      : 0:0:0:0:0:0:0:1 - - [30/août/2022:09:50:44 +0200] &quot;GET /api HTTP/1.1&quot; 200 123 781
  </code></pre>
  <p>And here's the code using a filter to log the authenticated user :</p>
  <pre><code>@Bean
  public GlobalFilter userLoggingFilter() {
      return (exchange, chain) -&gt;
              exchange.getPrincipal()
                      .map(Principal::getName)
                      .defaultIfEmpty(&quot;&lt;none&gt;&quot;)
                      .flatMap(username -&gt; {
                                  log.info(exchange.getLogPrefix() + &quot;logged user: &quot; + username);
                                  return chain.filter(exchange);
                              }
                      );
  }
  </code></pre>
  <p>which sucessfully retrieves the user from the security context :</p>
  <pre><code>2022-08-30 09:56:14.409  INFO 10372 --- [     parallel-2] g.m.x.g.FiltersConfiguration : [be8406e2-2] logged user: doej
  </code></pre>
  <p>I'm starting to think that I'm missing some basic concept here because without the <code>user</code> information access logs are pretty much useless in my case and I was really expecting to be handled in even the most default configuration.</p>