SecurityContext 전파 — 인증 정보는 요청 처리 동안 어떻게 유지될까

SecurityContext context = SecurityContextHolder.getContext();
Authentication authentication = context.getAuthentication();
String username = authentication.getName();

HTTP 요청 → 서블릿 스레드 (Thread-1)
    │
    ├── SecurityContextHolderFilter: 세션에서 SecurityContext 복원
    │
    ├── Controller: SecurityContextHolder.getContext() → Thread-1의 ThreadLocal
    │       │
    │       └── Service: SecurityContextHolder.getContext() → 같은 Thread-1
    │              │
    │              └── Repository: SecurityContextHolder.getContext() → 같은 Thread-1
    │
    └── SecurityContextHolderFilter: SecurityContext를 세션에 저장, ThreadLocal 정리

첫 번째 요청 (로그인):
SecurityContextHolderFilter → 인증 성공 → SecurityContext를 세션에 저장

두 번째 요청:
SecurityContextHolderFilter → 세션에서 SecurityContext 복원 → ThreadLocal에 설정

요청 완료:
SecurityContextHolderFilter → ThreadLocal 정리

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .sessionManagement(session -> session
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class)
        .build();
}

@Async
public void sendNotification(Long userId) {
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    // auth == null! SecurityContext가 전파되지 않음
}

@Configuration
@EnableAsync
public class AsyncConfig implements AsyncConfigurer {

    @Override
    public Executor getAsyncExecutor() {
        ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
        executor.setCorePoolSize(5);
        executor.setMaxPoolSize(10);
        executor.setQueueCapacity(25);
        executor.initialize();
        return new DelegatingSecurityContextAsyncTaskExecutor(executor);
    }
}

@PostConstruct
public void init() {
    SecurityContextHolder.setStrategyName(
        SecurityContextHolder.MODE_INHERITABLETHREADLOCAL);
}

public CompletableFuture<Void> processAsync() {
    SecurityContext context = SecurityContextHolder.getContext();

    return CompletableFuture.runAsync(() -> {
        try {
            SecurityContextHolder.setContext(context);
            doProcess();
        } finally {
            SecurityContextHolder.clearContext();
        }
    });
}

@GetMapping("/api/me")
public Mono<UserDto> getCurrentUser() {
    return ReactiveSecurityContextHolder.getContext()
        .map(SecurityContext::getAuthentication)
        .map(auth -> UserDto.from(auth.getPrincipal()));
}