title: Spring Boot Security Context return null when using a JWT token
body: <p>I have created a REST API that require a authentication with JWT.</p>
  
  <p>My implementation is very similar with the code found on <a href="https://auth0.com/blog/securing-spring-boot-with-jwts/" rel="noreferrer">https://auth0.com/blog/securing-spring-boot-with-jwts/</a></p>
  
  <p>When I try to return the current user, I always receive a <code>null</code> return.</p>
  
  <p>My code:</p>
  
  <p><strong>Websecurity</strong>:</p>
  
  <pre><code>public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.csrf().disable().authorizeRequests()
        // login
        .antMatchers(HttpMethod.POST, "/login")
        .permitAll()
  
        .anyRequest()
        .authenticated()
        .and()
        .addFilterBefore(new JWTLoginFilter(
          "/login", authenticationManager(), logService), UsernamePasswordAuthenticationFilter.class)
        .addFilterBefore(new JWTAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
  }
  </code></pre>
  
  <p><strong>JWTAuthenticationFilter</strong>:</p>
  
  <pre><code>public class JWTAuthenticationFilter extends GenericFilterBean {
  
    @Override
    public void doFilter(
        ServletRequest req,
        ServletResponse res,
        FilterChain filterChain) throws IOException, ServletException {
  
      Authentication authentication = TokenAuthenticationService.getAuthentication((HttpServletRequest)req);
  
      SecurityContextHolder.getContext().setAuthentication(authentication);
      filterChain.doFilter(req, res);
    }
  }
  </code></pre>
  
  <p>I don't included all the code of JWT authentication, because JWT is working ok, user access too.
  I believe the problem is in the filter or some configuration.</p>
  
  <p>Then, I made a <code>facade</code> to get the current user on a <code>service</code> or <code>controller</code>, with the following code (method 4 on <a href="http://www.baeldung.com/get-user-in-spring-security" rel="noreferrer">http://www.baeldung.com/get-user-in-spring-security</a>):</p>
  
  <pre><code>public Authentication getAuthentication() {
      return SecurityContextHolder.getContext().getAuthentication();
  }
  </code></pre>
  
  <p>but this don't worked.
  - <code>SecurityContextHolder.getContext()</code> returned <code>org.springframework.security.core.context.SecurityContextImpl@ffffffff: Null authentication</code>.
  - <code>SecurityContextHolder.getContext().getAuthentication()</code> returned <code>null</code> object.</p>
  
  <p><strong>Update (and solution)</strong>:</p>
  
  <p>In my controller, if I use this code:</p>
  
  <pre><code>SecurityContext context = SecurityContextHolder.getContext();
  Authentication authentication = context.getAuthentication();
  </code></pre>
  
  <p>I can get the current user, but, in my service, the exact same code don't work.
  But then, I remember that <code>SecurityContext</code> is "lost" on another thread (source: <a href="https://docs.spring.io/spring-security/site/docs/current/reference/html/concurrency.html" rel="noreferrer">https://docs.spring.io/spring-security/site/docs/current/reference/html/concurrency.html</a>), and my service is async</p>
  
  <pre><code>@Async
  public CompletableFuture&lt;Optional&lt;ViewUserDto&gt;&gt; findByLogin(String login) throws InterruptedException {
  ...
  }
  </code></pre>
  
  <p>So, using the code found here: <a href="https://stackoverflow.com/a/40347437/4794469">https://stackoverflow.com/a/40347437/4794469</a>, everything works correctly.
  I don't known if this can bring any side effects for my code yet (all unit tests worked)</p>