在 request 之间共享 SecurityContext

           //Stores the supplied security context in the session 
  protected void saveContext(SecurityContext context) {
             final Authentication authentication = context.getAuthentication();
             HttpSession httpSession = request.getSession(false);
 
 
             // See SEC-776
             if (authentication == null || authenticationTrustResolver.isAnonymous(authentication)) {
                 if (logger.isDebugEnabled()) {
                     logger.debug("SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.");
                 }
 
 
                 if (httpSession != null && !contextObject.equals(contextBeforeExecution)) {
                     // SEC-1587 A non-anonymous context may still be in the session
                     // SEC-1735 remove if the contextBeforeExecution was not anonymous
                     httpSession.removeAttribute(springSecurityContextKey);
                 }
                 return;
             }
 
 
             if (httpSession == null) {
                 httpSession = createNewSessionIfAllowed(context);
             }
 
 
             // If HttpSession exists, store current SecurityContext but only if it has
             // actually changed in this thread (see SEC-37, SEC-1307, SEC-1528)
             if (httpSession != null) {
                 // We may have a new session, so check also whether the context attribute is set SEC-1561
                 if (contextChanged(context) || httpSession.getAttribute(springSecurityContextKey) == null) {
  httpSession.setAttribute(springSecurityContextKey, context);
 
 
                     if (logger.isDebugEnabled()) {
                         logger.debug("SecurityContext stored to HttpSession: '" + context + "'");
                     }
                 }
             }
         }
  
 // 
 private SecurityContext readSecurityContextFromSession(HttpSession httpSession) {
         final boolean debug = logger.isDebugEnabled();
 
 
         if (httpSession == null) {
             if (debug) {
                 logger.debug("No HttpSession currently exists");
             }
 
 
             return null;
         }
 
 
         // Session exists, so try to obtain a context from it.
 
 
         Object contextFromSession = httpSession.getAttribute(springSecurityContextKey);
 
 
         if (contextFromSession == null) {
             if (debug) {
                 logger.debug("HttpSession returned null object for SPRING_SECURITY_CONTEXT");
             }
 
 
             return null;
         }
 
 
         // We now have the security context object from the session.
         if (!(contextFromSession instanceof SecurityContext)) {
             if (logger.isWarnEnabled()) {
                 logger.warn(springSecurityContextKey + " did not contain a SecurityContext but contained: '"
                         + contextFromSession + "'; are you improperly modifying the HttpSession directly "
                         + "(you should always use SecurityContextHolder) or using the HttpSession attribute "
                         + "reserved for this class?");
             }
 
 
             return null;
         }
 
 
         if (debug) {
             logger.debug("Obtained a valid SecurityContext from " + springSecurityContextKey + ": '" + contextFromSession + "'");
         }
 
 
         // Everything OK. The only non-null return from this method.
 
 
         return (SecurityContext) contextFromSession;
     }