title: Why I'm using "request.getPrincipal()" to get the authenticated user?
body: <p>This might be some "rookie" question, but I can't find a direct answer during my research.</p>
  
  <p>Working with a JAVA Web project (that makes use of SSO), there are some libraries getting the logged user the following way: "request.getUserPrincipal();".</p>
  
  <p>It was alarming to me, receiving this data on the request, since that could be imposed (my first assumption is that the request comes from the webclient/browser).</p>
  
  <p>But checking the running application, I don't see a single place where that data travels in the request (more than the log in page itself, that of course sends username and password).</p>
  
  <p>So, I'm assuming that the server is augmenting the request and putting the user information that is actually stored in the session (which would be secure) but I can't find any clear documentation that supports my theory.</p>
  
  <p>So, could anybody explain or point me to some good and straight explanation?</p>
  
  <p>Thanks! Regards.</p>