This repository was archived by the owner on Dec 19, 2023. It is now read-only.
This repository was archived by the owner on Dec 19, 2023. It is now read-only.
Wrong SecurityContext with async-mode-enabled: true results #632
Description
Describe the bug
The Spring Security Context obtained by the OncePerRequestFilter is wrong when upgrading to 11.1.0 with async-mode-enabled: true by default.
This can lead to very serious security concerns as the context is also not cleared correctly so requests get sometimes authorized with credentials from other users.
To Reproduce
Create a Filter and try to access the context with SecurityContextHolder within the dataFetchers.
Expected behavior
The Security Context should contain the correct context.