The SecurityContextHolder in Spring Security has three operation modes that determine how and where the SecurityContext is stored per thread/request:

🔐 1. MODE_THREADLOCAL (Default)

• Default mode.
• Stores SecurityContext in a ThreadLocal variable.
• ✅ Best for most web applications where each request runs on a dedicated thread.
• ⚠️ Not suitable for asynchronous or reactive programming models without special care.

java
CopyEdit
SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_THREADLOCAL);

🔄 2. MODE_INHERITABLETHREADLOCAL

• Stores SecurityContext in an InheritableThreadLocal.
• Child threads inherit the parent thread’s SecurityContext.
• ✅ Useful when spawning new threads that need access to the authenticated user (e.g., background jobs).
• ⚠️ Be cautious with thread pooling—it can lead to context leaks.

java
CopyEdit
SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL);

🧵 3. MODE_GLOBAL

• Stores SecurityContext in a static global variable (singleton).
• ❌ NOT recommended—not thread-safe, shared across all threads and users.
• Can lead to severe security issues in concurrent environments.