shivvani-r opened a new pull request, #15997: URL: https://github.com/apache/dubbo/pull/15997
## What is the purpose of the change This PR addresses [#15988](https://github.com/apache/dubbo/issues/15988) a security context pollution issue in `ContextHolderAuthenticationResolverFilter`. The filter sets authentication data into the `SecurityContextHolder` (ThreadLocal) but fails to clear it. Since Dubbo uses thread pools, this causes thread pollution where subsequent requests may inherit stale credentials. This fix ensures `clearContext()` is always called in a `finally` block. ## Brief changelog * **Fix:** Wrapped invocation in a `try-finally` block to ensure `SecurityContextHolder.clearContext()` is always called. * **Test:** Added `ContextHolderAuthenticationResolverFilterTest` to verify thread cleanup. ## Verifying this change * Added a new unit test `ContextHolderAuthenticationResolverFilterTest`. * The test simulates thread pollution by setting a dirty `SecurityContext` and asserts that the context is successfully cleared (`null`) after filter execution. ## Checklist - [x] Make sure there is a [GitHub_issue](https://github.com/apache/dubbo/issues) field for the change. - [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why. - [x] Write necessary unit-test to verify your logic correction. If the new feature or significant change is committed, please remember to add sample in [dubbo samples](https://github.com/apache/dubbo-samples) project. - [x] Make sure gitHub actions can pass. [Why the workflow is failing and how to fix it?](../CONTRIBUTING.md) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
