beginnerSpring Security Architecture: The Filter Chain & Internal Flow

What's stored inside the SecurityContextHolder, and how long does it live?

It holds a SecurityContext object wrapping the current Authentication (principal, credentials, authorities). By default its storage strategy is a ThreadLocal, so it lives only for the duration of the current thread/request unless the app is session-based, in which case Spring Security also persists/restores the SecurityContext to/from the HttpSession via SecurityContextPersistenceFilter (or SecurityContextHolderFilter in Spring Security 6).

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to Why does Spring Security use an AnonymousAuthenticationToken instead of leaving Authentication null? →← Back to all Spring Security questions