Add support for automatic context-propagation with Micrometer

Closes gh-16665

web/spring-security-web.gradle

@@ -36,6 +36,7 @@ dependencies {
 	api 'org.springframework:spring-web'
 
 	optional 'com.fasterxml.jackson.core:jackson-databind'
+	optional 'io.micrometer:context-propagation'
 	optional 'io.projectreactor:reactor-core'
 	optional 'org.springframework:spring-jdbc'
 	optional 'org.springframework:spring-tx'

web/src/main/java/org/springframework/security/web/server/ServerWebExchangeThreadLocalAccessor.java

@@ -0,0 +1,63 @@
+/*
+ * Copyright 2002-2025 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.server;
+
+import io.micrometer.context.ThreadLocalAccessor;
+
+import org.springframework.util.Assert;
+import org.springframework.web.server.ServerWebExchange;
+
+/**
+ * A {@link ThreadLocalAccessor} for accessing a {@link ServerWebExchange}.
+ * <p>
+ * This class adapts the existing Reactor Context attribute
+ * {@code ServerWebExchange.class} to the {@link ThreadLocalAccessor} contract to allow
+ * Micrometer Context Propagation to automatically propagate a {@link ServerWebExchange}
+ * in Reactive applications. It is automatically registered with the
+ * {@link io.micrometer.context.ContextRegistry} through the
+ * {@link java.util.ServiceLoader} mechanism when context-propagation is on the classpath.
+ *
+ * @author Steve Riesenberg
+ * @since 6.5
+ * @see io.micrometer.context.ContextRegistry
+ */
+public final class ServerWebExchangeThreadLocalAccessor implements ThreadLocalAccessor<ServerWebExchange> {
+
+	private static final ThreadLocal<ServerWebExchange> threadLocal = new ThreadLocal<>();
+
+	@Override
+	public Object key() {
+		return ServerWebExchange.class;
+	}
+
+	@Override
+	public ServerWebExchange getValue() {
+		return threadLocal.get();
+	}
+
+	@Override
+	public void setValue(ServerWebExchange exchange) {
+		Assert.notNull(exchange, "exchange cannot be null");
+		threadLocal.set(exchange);
+	}
+
+	@Override
+	public void setValue() {
+		threadLocal.remove();
+	}
+
+}

web/src/main/resources/META-INF/services/io.micrometer.context.ThreadLocalAccessor

@@ -0,0 +1 @@
+org.springframework.security.web.server.ServerWebExchangeThreadLocalAccessor

web/src/test/java/org/springframework/security/web/ServerWebExchangeThreadLocalAccessorTests.java

@@ -0,0 +1,118 @@
+/*
+ * Copyright 2002-2025 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web;
+
+import java.util.concurrent.CountDownLatch;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import org.springframework.core.task.SimpleAsyncTaskExecutor;
+import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
+import org.springframework.mock.web.server.MockServerWebExchange;
+import org.springframework.security.web.server.ServerWebExchangeThreadLocalAccessor;
+import org.springframework.web.server.ServerWebExchange;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
+
+/**
+ * Tests for {@link ServerWebExchangeThreadLocalAccessor}.
+ *
+ * @author Steve Riesenberg
+ */
+public class ServerWebExchangeThreadLocalAccessorTests {
+
+	private ServerWebExchangeThreadLocalAccessor threadLocalAccessor;
+
+	private ServerWebExchange exchange;
+
+	@BeforeEach
+	public void setUp() {
+		this.threadLocalAccessor = new ServerWebExchangeThreadLocalAccessor();
+		this.exchange = MockServerWebExchange.builder(MockServerHttpRequest.get("/")).build();
+	}
+
+	@AfterEach
+	public void tearDown() {
+		this.threadLocalAccessor.setValue();
+	}
+
+	@Test
+	public void keyAlwaysReturnsServerWebExchangeClass() {
+		assertThat(this.threadLocalAccessor.key()).isEqualTo(ServerWebExchange.class);
+	}
+
+	@Test
+	public void getValueWhenThreadLocalNotSetThenReturnsNull() {
+		assertThat(this.threadLocalAccessor.getValue()).isNull();
+	}
+
+	@Test
+	public void getValueWhenThreadLocalSetThenReturnsServerWebExchange() {
+		this.threadLocalAccessor.setValue(this.exchange);
+		assertThat(this.threadLocalAccessor.getValue()).isSameAs(this.exchange);
+	}
+
+	@Test
+	public void getValueWhenThreadLocalSetOnAnotherThreadThenReturnsNull() throws InterruptedException {
+		CountDownLatch threadLocalSet = new CountDownLatch(1);
+		CountDownLatch threadLocalRead = new CountDownLatch(1);
+		CountDownLatch threadLocalCleared = new CountDownLatch(1);
+
+		Runnable task = () -> {
+			this.threadLocalAccessor.setValue(this.exchange);
+			threadLocalSet.countDown();
+			try {
+				threadLocalRead.await();
+			}
+			catch (InterruptedException ignored) {
+			}
+			finally {
+				this.threadLocalAccessor.setValue();
+				threadLocalCleared.countDown();
+			}
+		};
+		try (SimpleAsyncTaskExecutor taskExecutor = new SimpleAsyncTaskExecutor()) {
+			taskExecutor.execute(task);
+			threadLocalSet.await();
+			assertThat(this.threadLocalAccessor.getValue()).isNull();
+			threadLocalRead.countDown();
+			threadLocalCleared.await();
+		}
+	}
+
+	@Test
+	public void setValueWhenNullThenThrowsIllegalArgumentException() {
+		// @formatter:off
+		assertThatIllegalArgumentException()
+			.isThrownBy(() -> this.threadLocalAccessor.setValue(null))
+			.withMessage("exchange cannot be null");
+		// @formatter:on
+	}
+
+	@Test
+	public void setValueWhenThreadLocalSetThenClearsThreadLocal() {
+		this.threadLocalAccessor.setValue(this.exchange);
+		assertThat(this.threadLocalAccessor.getValue()).isSameAs(this.exchange);
+
+		this.threadLocalAccessor.setValue();
+		assertThat(this.threadLocalAccessor.getValue()).isNull();
+	}
+
+}