title: Spring-test HttpFirewall is blocking requests from threads other than MAIN
body: <p>I'm having some trouble while testing out one of my controllers.</p>
  <p>When trying to make a mock request inside of a <code>Thread</code> instance using <code>thread.start()</code>, apparently, the <code>HttpFirewall</code> which is declared inside of the <code>FilterChainProxy</code> is filtering my request as <code>org.springframework.security.web.firewall.FirewalledRequest</code>.</p>
  <p>Every codeline after the <code>mock.perform(req)</code> line was never executed, the Controller method was never invoked, I could never knew what happened with that Thread and a log was given by the logger (while the <code>MockMvc mock</code> instance is trying to perform the <code>req</code> I assume):</p>
  <p><code>2021-03-26 15:43:35.252 DEBUG 6972 --- [       Thread-1] o.s.security.web.FilterChainProxy        : Securing GET /file/image/bytes</code></p>
  <p>This was not the case when I tried to make the mock request directly in the test method, which is executed in the MAIN thread, the request came through, Controller method was invoked and the result was as predicted.</p>
  <p>Here is the code which I used to test the Controller method in <code>Thread-1</code>:</p>
  <pre><code>@Test
  public void testGetImageBytes() throws Exception {
      Thread thread = new Thread() {
          @Override
          public void run() {
              final UserRequestPostProcessor ADMIN = user(&quot;admin&quot;).roles(&quot;ADMIN&quot;);
              RequestBuilder req = MockMvcRequestBuilders.get(&quot;/file/image/bytes&quot;).with(ADMIN);
              MvcResult result;
  
              try {
                  ResultActions action = mock.perform(req);
                  // following lines were never executed
                  result = action.andReturn(); 
  
                  MockHttpServletResponse res = result.getResponse();
  
                  Assert.isTrue(res.getStatus() == HttpStatus.OK.value(), &quot;Resquest failed&quot;);
              } catch (Exception e) {
                  // TODO Auto-generated catch block
                  e.printStackTrace();
              }
          }
      };
  
      thread.start();
  }
  </code></pre>
  <p>I'm very confused about the fact that my endpoint was being secured against requests by which other Threads than MAIN executed. Any suggestions would be very appreciated, thank you.</p>