How to update authentication in auditorAware

    @Configuration
    @EnableJpaAuditing(auditorAwareRef = "auditorProvider")
    public class JpaAuditingConfiguration {
	
      @Bean
      @Scope(value= ConfigurableBeanFactory.SCOPE_PROTOTYPE)
      public AuditorAware<String> auditorProvider() {

    	Authentication authentication 
             = SecurityContextHolder.getContext().getAuthentication();
        if (authentication == null) {
            return () -> Optional.<String>empty();
        }
        return () -> Optional.of(authentication.getName());
      }
    
      public static void main(String[] args) {
        SpringApplication.run(JpaAuditingConfiguration.class, args);
      }
    }

    @Configuration
    @EnableWebSecurity
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
	  @Autowired
	  private UserDetailServiceImpl userDetailsService;

	  @Autowired
	  public void configureGlobal(AuthenticationManagerBuilder auth) 
                               throws Exception {
		auth.userDetailsService(userDetailsService)
             .passwordEncoder(new BCryptPasswordEncoder());
	  }

	  @Override
	  protected void configure(HttpSecurity http) throws Exception {

		http.csrf().disable().cors().and()
				.logout()
		        .invalidateHttpSession(true)
		        .clearAuthentication(true)
		        .logoutSuccessUrl("/logout/success")
		        .and().authorizeRequests()
				.antMatchers(HttpMethod.POST, "/login").permitAll()
				.antMatchers(HttpMethod.GET, "/logout/**").permitAll()
				.anyRequest().authenticated().and()
				// Filter for the api/login requests
				.addFilterBefore(new LoginFilter("/login", 
                                     authenticationManager()),
						UsernamePasswordAuthenticationFilter.class)
				// Filter for other requests to check JWT in header
				.addFilterBefore(new AuthenticationFilter(), 
                    UsernamePasswordAuthenticationFilter.class);
		
	}

    public class AuthenticationFilter extends GenericFilterBean {
      @Override
      public void doFilter(ServletRequest request, 
                           ServletResponse response, 
                           FilterChain filterChain) 
                           throws IOException, ServletException {
       Authentication authentication 
        = AuthenticationService
                  .getAuthentication((HttpServletRequest)request);
    
       SecurityContext securityContext 
                    = SecurityContextHolder.getContext();
       securityContext.setAuthentication(authentication);
       filterChain.doFilter(request, response);
      }
    }

auditorProvider seems to be called only once when application starts. authentication is called before it is set in doFilter. authentication object is always null and doesn't update when it's set later in doFilter. When I update a row in db, createdBy and lastModifiedBy are always null.

My doFilter seems to be called when an HTTP request is processed.

I followed a tutorial to learn spring security, but after troubleshooting for a few hours and followed through many similar tutorial, still can't figure out how to properly set the authentication in sequence so when I update a row, spring will update lastModifiedBy and createdBy automatically.

• Your issue is that you are creating an anonymous AuditorAware but you are evaluating the SecurityContextHolder.getContext().getAuthentication() outside the body so whatever at that creation time will be kept inside the body.

	@Bean
	@Scope(value= ConfigurableBeanFactory.SCOPE_PROTOTYPE)
	public AuditorAware<String> auditorProvider() {

		return () -> {
			Authentication authentication 
					= SecurityContextHolder.getContext().getAuthentication();
			return Optional.ofNullable(authentication)
					.map(Authentication::getName);
		};
	}

• You could say, you have SCOPE_PROTOTYPE but it is useless if it was autowired into a singleton instance that framework uses.