DelegatingSecurityContextAsyncTaskExecutor from Spring not working correctly with Vaadin

[kmartin88]

Description of the bug

We have a project with Vaadin and Spring Boot and as we need to have the current user inside async methods, we use a DelegatingSecurityContextAsyncTaskExecutor bean like this:

@Bean
public DelegatingSecurityContextAsyncTaskExecutor taskExecutor() {
    ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
    //configure the executor
    return new DelegatingSecurityContextAsyncTaskExecutor(executor);
}

This has always worked perfectly but since we upgraded to Vaadin 24 it didn't work anymore. Inside the async methods we got a null authentication instead of the current user.

We first thought it is a bug in Spring Security 6, so we opened an issue there (spring-projects/spring-security#16588) but upon further investigation we saw that the VaadinAwareSecurityContextHolderStrategyConfiguration is just too late and we need to wait for it so that the DelegatingSecurityContextAsyncTaskExecutor gets initalized with the correct SecurityContextHolderStrategy.

We could fix it by annotating our taskExecutor bean method with @DependsOn("VaadinSecurityContextHolderStrategy").
I saw that there are other problems because of the order of this, like in this issue so maybe it would be a good idea to put an @Order annotation on the Autoconfiguration to make sure it sets the SecurityContextHolderStrategy early enough?

At least it would be nice to have something about this in the documentation.

Expected behavior

The SecurityContext should be propagated correctly into async threads as it did before.

Minimal reproducible example

Create a project with Spring Boot and Vaadin 24, create a @Configuration class creating a DelegatingSecurityContextAsyncTaskExecutor as in the code snippet above, configure it with Spring Security and a Login.
Implement a method in some service annotated with @Async and inside this method call SecurityContextHolder.getContext().getAuthentication() and create some UI component calling this method, e.g. a Button. Then you should see that SecurityContextHolder.getContext().getAuthentication() doesn't return the current user.

Versions

• Vaadin / Flow version: 24.4.22
• Java version: 17
• OS version: not relevant
• Browser version (if applicable): not relevant
• Application Server (if applicable): not relevant
• IDE (if applicable): not relevant