title: How does spring security maintain authentication information between request?
body: <p>How does spring security maintain authentication info between requests?</p>
  
  <p>Does it use any thing similar to jSessionId or uses an entirely different mechanism. </p>
  
  <p>Further, I see that the <a href="https://docs.spring.io/spring-security/site/docs/4.2.12.RELEASE/apidocs/org/springframework/security/access/intercept/AbstractSecurityInterceptor.html" rel="nofollow noreferrer">AbstractSecurityInterceptor</a> (I mean, any of it's implementations) is responsible for intercepting the incoming request and verify if a request is already authorized using <code>Authentication.isAuthenticated()</code> and then depending on the condition either validate the request or send the Authentication request to an AuthenticationManager Implementation. So, in other words, how does AbstractSecurityInterceptor differentiate between first request and subsequent request. </p>