[SHIRO-799] When ThreadContext works with ThreadPool bring security issues

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.4.0, 1.7.0
• Component/s: Authorization (access control)
• Assignee: Unassigned
• Reporter: leven.chen
• Created: 13/Nov/20 04:28
• Updated: 13/Nov/20 16:32

Description

Beacause ThreadContext use InheritableThreadLocalMap  , but when it work with ThreadPool , it  bring security problem. Although, we can use  SubjectAwareExecutor or  SubjectAwareExecutorService to fix this problem. but not elegant . Maybe use ThreadLocal or Transmittable-thread-local  better then InheritableThreadLocal