Answers

1. The security context stores the principal using SecurityContextHolder and is always available in the same thread of execution. The security context allows you to extract the principal during the flow execution and use it wherever you want. This is where a security annotation such as @PreAuthorize makes use of it for validation. The principal is the currently logged-in user. It can either be an instance of UserDetails or a string carrying a username. You can use the following code to extract it:

   Object principal = SecurityContextHolder                   .getContext().getAuthentication()                   .getPrincipal();if (principal instanceof UserDetails) {  String username =              ((UserDetails)principal...