SecurityContextHolder class abstract final

The entry point to the current user: static methods that read, set and scope the current SecurityContext.

Every security check reads the user from here, so code never passes the user around. You use it to find out who is calling, to log a user in (in a Flutter app or a custom login), and to run work as a given user. On a server the starter's filter chain gives every request its own context; outside every scope there is one context for the whole program. The calls go to a SecurityContextHolderStrategy, ZoneSecurityContextHolderStrategy unless you change it.

// Who is calling?
final user = SecurityContextHolder.getContext().authentication;

// A nightly job calls secured services as a system user, in a scope
// of its own so no request sees that user.
await SecurityContextHolder.runWithContext(
  () => reports.generate(),
  SecurityContextImpl(
    TestingAuthenticationToken('system', null, ['ROLE_SYSTEM']),
  ),
);

Spring (Java):

Authentication user =
    SecurityContextHolder.getContext().getAuthentication();

Properties

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

clearContext() → void

Removes the current context of the current scope, which logs the user out of it.

createEmptyContext() → SecurityContext

A new context with no user, not yet stored anywhere.

getContext() → SecurityContext

The current context, never null (an empty one is created when there is none). Read .authentication on it for the user.

getContextHolderStrategy() → SecurityContextHolderStrategy

The strategy in use; a ZoneSecurityContextHolderStrategy unless setContextHolderStrategy replaced it.

runWithContext<R>(R body(), [SecurityContext? context]) → R

Runs body as the user of context (no user when omitted) and returns its result.

setContext(SecurityContext context) → void

Makes context current in the current scope; this is how a login takes effect.

setContextHolderStrategy(SecurityContextHolderStrategy strategy) → void

Replaces the strategy for the whole program.