title: Can SecurityContextHolder Shared across users
body: <p>In response to this question <a href="https://stackoverflow.com/questions/6408007/spring-securitys-securitycontextholder-session-or-request-bound">securitycontextholder-session-or-request-bound</a>.
  I was implementing CustomAuthenticationManager using this example <a href="http://krams915.blogspot.co.id/2010/12/spring-security-mvc-integration-using_26.html" rel="nofollow noreferrer">how-to-customAuthenticationManager</a>. It turns out, my user experience get Accross Session. </p>
  
  <p>For example, User A interacts with web App, sometimes when accessing profile, User A could get User B Profile(this because the app is retrieving UserProfileLoggedIn from SecurityContextHolder's principal and accessing database) and at the same time User B was logged on, but probably not accessing profile.</p>
  
  <p>I wonder is this a SecurityContextHolder leakage ? I know that SecurityContextHolder is just a way of implement HttpSession as a container to contain userDetails and so on.</p>
  
  <p>Now, after having the problems, I'm changing the customAuthenticationManager to customAuthenticationProvider. For additional information, the users is around 100-500 concurrent users at mid day.</p>
  
  <p>For additional information, I'm implementing SecurityContextHolder in my @Service Class, so another team member can get easily </p>
  
  <pre><code>@Service
  public MyServiceImpl implement MyServiceInterface{
      public UserDetail findUser(){
         return (UserDetail) SecurityContextHolder.getContext().
                getAuthentication().getPrincipal();
       }
  }
  </code></pre>