title: Spring Boot apps. SecurityContextHolder vs. HttpSession
body: <p>In Web app. is so common to store the user details in the session, But if in Spring Boot you configure you <code>SecurityConfig</code> class as follows:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {                  
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          auth
              .userDetailsService(userSecurityService)
             .passwordEncoder(passwordEncoder());
      }
  ...
  }
  </code></pre>
  
  <p>and </p>
  
  <pre><code>@Service
  public class UserSecurityService implements UserDetailsService {
  
      /** The application logger */
      private static final Logger LOG = LoggerFactory.getLogger(UserSecurityService.class);
  
      @Autowired
      private UserRepository userRepository;
  
      @Override
      public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
  
          LOG.info("Searching user with email: " + email);
  
          User user = userRepository.findByEmail(email);
  
          if (null == user) {
              LOG.warn("Username {} not found", email);
              throw new UsernameNotFoundException("Username " + email + " not found");
          }
          return user;
      }
  }
  </code></pre>
  
  <p>and </p>
  
  <pre><code>public class User implements Serializable, UserDetails {
  ..
  }
  </code></pre>
  
  <p>then you can grap all the info from the logged user using always</p>
  
  <pre><code>User user = (User)SecurityContextHolder.getContext().getAuthentication().getPrincipal()
  </code></pre>
  
  <p>so.. storing the user info in the <code>HttpSession</code> is a bad practice, old practice or I miss something ?</p>