Spring Security’s SecurityContext is the cornerstone of authentication and authorization in Spring applications. It stores critical user details like authentication token, granted authorities, and principal information. However, when operations span multiple threads—common in asynchronous processing or reactive programming—propagating this context becomes a significant challenge. This guide explores various strategies to ensure your security context travels correctly across thread boundaries.

Understanding SecurityContext and ThreadLocal

At the heart of Spring Security lies the SecurityContextHolder, which uses a ThreadLocal strategy by default. This means each thread maintains its own isolated security context, which works perfectly in standard synchronous request-response cycles but breaks down when new threads are spawned.

The SecurityContextHolder supports three persistence strategies:

• MODE_THREADLOCAL: Default strategy where context is bound to the current thread
• MODE_INHERITABLETHREADLOCAL: Context is inherited by child threads created by the current thread
• MODE_GLOBAL: Single context shared across all threads (rarely used in production)

Spring Security is the de facto standard for securing Java applications, offering robust support for OAuth2, LDAP, and standard form logins. But what happens when “standard” isn’t enough?

You might face a scenario where user credentials live in a legacy mainframe, a proprietary API, or a multi-tenant database with complex sharding rules. In these cases, the default DaoAuthenticationProvider fails. Trying to hack standard filters to fit these requirements leads to brittle code, security vulnerabilities, and maintenance nightmares.

The solution lies in Spring Security’s modular architecture. By implementing a Custom Authentication Provider, you can inject your specific business logic directly into the security lifecycle without compromising the framework’s integrity.

In this guide, we will build a production-ready Custom Authentication Provider using Spring Boot 3 and Spring Security 6. We will cover the architecture, implementation details, configuration, and critical edge cases you must handle.

Understanding the Architecture

Before writing code, it is crucial to understand where your custom logic fits. Spring Security uses a delegation model.

1. AuthenticationFilter: Intercepts the request.
2. AuthenticationManager: The interface defining how authentication is processed.
3. ProviderManager: The standard implementation that iterates through a list of providers.
4. AuthenticationProvider: The component that actually validates the user.

I’ve been shipping Java services for over a decade. I’ve tuned Tomcat thread pools, profiled connection leaks, and once reluctantly rewrote a critical service in WebFlux because blocking threads were killing us at scale. So when Java 21 landed with virtual threads baked in, I didn’t just read the JEP — I immediately threw it at a production-like load test.

The results were not subtle. This post is what I wish existed back then: an honest, methodical walkthrough of enabling virtual threads in Spring Boot 3.4, with real benchmark methodology, the gotchas that will actually bite you in production, and a clear-eyed take on when virtual threads won’t help at all.

Communicating between microservices is a fundamental aspect of modern application development. Often, these services need to be secured. One of the simplest and most widely supported methods for securing REST APIs is Basic Authentication. In this guide, we’ll walk through how to configure and use Spring Boot’s RestTemplate to consume a REST API protected with Basic Auth.

We’ll cover the modern, recommended approach using Spring Security’s component-based configuration, updating older patterns you might find in other tutorials.

Project Setup

First, ensure your Spring Boot project includes the spring-boot-starter-web dependency. This starter conveniently bundles everything we need, including Spring MVC for creating the REST service, Tomcat as the embedded server, and RestTemplate support.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

You’ll also need the spring-boot-starter-security dependency to enable security features.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>