title: Spring Security: same SecurityContext-instance in multiple ThreadLocals, how does that work?
body: <p>Ive some questions about Spring Security 3.0.5 and the SecurityContext. First of all, Ill try to conclude what I know:</p>
  
  <ul>
  <li>SecurityContextHolder stores SecurityContext</li>
  <li>Between Request, SecurityContext is stored in HttpSession</li>
  <li>Begin of Request: SecurityContextHolder gets SecurityContext from HttpSession</li>
  <li><p>End of Request: SecurityContextHolder puts SecurityContext in HttpSession</p></li>
  <li><p>During the Request, on the server, SecurityContextHolder uses a ThreadLocal. Everywhere in the application (same request), the SecurityContext can be accessed</p></li>
  </ul>
  
  <p>Now my question....</p>
  
  <p>--> Two Requests: the SecurityContext-instance will be shared</p>
  
  <p>How does this work? I mean, SecurityContextHolder uses a ThreadLocal for Each Request.
  2 Request = 2 ThreadLocals</p>
  
  <p>Each request does: getSessionAttribute (SecurityContext) from HttpSession
  What happens if they work on the SecurityContext? Is the SecurityContext changed in all ThreadLocals?</p>
  
  <p>As far as I know: yes (??)</p>
  
  <p>How does this work? How can they work on the same instance? I mean, I really cant imagine how two different threads with two different ThreadLocals can work on the same instance?</p>
  
  <blockquote>
    <p>API (ThreadLocal):
    This class provides thread-local variables. These variables differ from their normal counterparts in that each thread that accesses one (via its get or set method) has its own, independently initialized copy of the variable. </p>
  </blockquote>
  
  <p>I mean, thats it: copy! maybe Im wrong and its not possible for two threads to work on the same SecurityContext? But Spring Security Documentation says so!</p>
  
  <p>Would be great if someone could explain that to me :-) Thank you!</p>