title: ReactiveSecurityContextHolder is empty in Spring WebFlux
body: <p>I am trying to use the ReactiveSecurityContextHolder with Spring WebFlux. Unfortunately, the SecurityContext is empty : </p>
  
  <pre><code>@Configuration
  public class Router {
  
      @Bean
      public RouterFunction&lt;ServerResponse&gt; routes(Handler handler) {
          return nest(
                  path("/bill"),
                  route(
                          GET("/").and(accept(APPLICATION_JSON)), handler::all));
      }
  
      @Component
      class Handler {
  
          Mono&lt;ServerResponse&gt; all(ServerRequest request) {
  
              ReactiveSecurityContextHolder.getContext()
                  .switchIfEmpty(Mono.error(new IllegalStateException("ReactiveSecurityContext is empty")))
                  .map(SecurityContext::getAuthentication)
                  .map(Authentication::getName)
                  .flatMap(s -&gt; Mono.just("Hi " + s))
                  .subscribe(
                          System.out::println,
                          Throwable::printStackTrace,
                          () -&gt; System.out.println("completed without a value")
                  );
  
              return ok().build();
          }
  
      }
  
  }
  </code></pre>
  
  <p>This code always throws the IllegalStateException. </p>
  
  <p>If I add a subscriberContext like shown <a href="https://spring.io/blog/2017/11/01/spring-security-5-0-0-rc1-released#reactivesecuritycontextholder" rel="noreferrer">here</a> :</p>
  
  <pre><code>Authentication authentication = new TestingAuthenticationToken("admin", "password", "ROLE_ADMIN");
  
  ReactiveSecurityContextHolder.getContext()
          .switchIfEmpty(Mono.error(new IllegalStateException("ReactiveSecurityContext is empty")))
          .map(SecurityContext::getAuthentication)
          .map(Authentication::getName)
          .flatMap(s -&gt; Mono.just("Hi " + s))
          .subscriberContext(ReactiveSecurityContextHolder.withAuthentication(authentication))
          .subscribe(
                  System.out::println,
                  Throwable::printStackTrace,
                  () -&gt; System.out.println("completed without a value")
          );
  </code></pre>
  
  <p>It works fine and print "Hi admin". But that's not the point, the article says "In a WebFlux application the <code>subscriberContext</code> is automatically setup using <code>ReactorContextWebFilter</code>". So I should be able to fetch the logged user.</p>
  
  <p>I have this configuration :</p>
  
  <pre><code>@EnableWebFluxSecurity
  @EnableReactiveMethodSecurity
  public class SecurityConfig {
  
      @Bean
      public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
          return http.authorizeExchange()
              .anyExchange().authenticated()
              .and().formLogin()
              .and().build();
      }
  
      @Bean
      public MapReactiveUserDetailsService userDetailsService() {
          UserDetails user = User.withDefaultPasswordEncoder()
              .username("user")
              .password("password")
              .roles("USER")
              .build();
  
          UserDetails admin = User.withDefaultPasswordEncoder()
              .username("admin")
              .password("password")
              .roles("ADMIN")
              .build();
  
          return new MapReactiveUserDetailsService(user, admin);
      }
  
  }
  </code></pre>
  
  <p>Am I missing something here ? If I put breakpoints in ReactorContextWebFilter, I can see that it is correctly called before each request. But my ReactiveSecurityContextHolder is always empty...</p>