title: Is there any scenario where SecurityContext won't get cleared from ThreadLocal after a request?
body: <p>For a Spring Security application using the default <a href="https://github.com/spring-projects/spring-security/blob/4.2.2.RELEASE/core/src/main/java/org/springframework/security/core/context/ThreadLocalSecurityContextHolderStrategy.java" rel="nofollow noreferrer">ThreadLocalSecurityContextHolderStrategy</a> to save the <code>Authentication</code> object into a <code>ThreadLocal</code> variable, is it possible for any sort of error to arise where Spring Security won't be able to clear the <code>ThreadLocal</code> before the request completes?</p>
  <p>The <a href="https://github.com/spring-projects/spring-security/blob/4.2.2.RELEASE/web/src/main/java/org/springframework/security/web/context/SecurityContextPersistenceFilter.java" rel="nofollow noreferrer">SecurityContextPersistenceFilter</a> performs the following:</p>
  <ol>
  <li>Loads <code>Authentication</code> (from <code>HttpSession</code> via <a href="https://github.com/spring-projects/spring-security/blob/4.2.2.RELEASE/web/src/main/java/org/springframework/security/web/context/HttpSessionSecurityContextRepository.java" rel="nofollow noreferrer">HttpSessionSecurityContextRepository</a>) to context (<code>SecurityContextHolder</code>).</li>
  <li>Filter chain is invoked for continued request execution by application.</li>
  <li><code>Authentication</code> is cleared from <code>SecurityContextHolder</code> so subsequent requests using the same <code>ThreadLocal</code> do not have invalid data.</li>
  </ol>
  <p>In short, is there any scenario where #3 won't be able to complete because of application issue, timeout, or other? If so, how should an application ensure appropriate <code>Authentication</code> detail for the current request (e.g. ensure data is valid for current request/user)?</p>