Axelix, a tool for debugging and monitoring Spring Boot applications, uses Java ScopedValue to manage security context propagation. The system consists of the Axelix Master, which handles UI and MCP server operations, and Spring Boot starters installed in monitored applications.
The development team replaced ThreadLocal with ScopedValue to pass authorization tokens from HTTP filters to the transport layer. Unlike ThreadLocal, which allows mutable state and requires manual cleanup, ScopedValue binds values within a specific execution scope and automatically clears them upon completion.
ScopedValue prevents unauthorized modification of the security context, as it lacks a set method. This ensures that identity information remains immutable throughout the call chain, mitigating security risks associated with accidental context leakage between requests in thread pools.
The team noted limitations: ScopedValue does not automatically propagate to arbitrary thread pools or CompletableFuture, and it does not prevent mutation of objects stored within the binding. The developers emphasize that explicit method parameters remain preferable for API contracts where the context is a core requirement.
