Is it safe to reuse UserDetails from SecurityContext instead of querying the database again?

Question

I am implementing JWT authentication with Spring Security. In this filter I validate the JWT, extract the email, and then load the user using UserDetailsService.

```javascript

   
  @Component
  @RequiredArgsConstructor
  public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtService jwtService;
    private final CustomUserDetailService userDetailService;

    @Override
    protected void doFilterInternal(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain filterChain) throws ServletException, IOException {

        String authorization = request.getHeader("Authorization");

        if (authorization == null || !authorization.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }

        String token = authorization.substring(7);

        if (!jwtService.isTokenValid(token)) {
            filterChain.doFilter(request, response);
            return;
        }

        Claims claim = jwtService.extractAllClaims(token);
        String email = claim.getSubject();

        UserDetails userDetails = userDetailService.loadUserByUsername(email);

        Authentication auth =
                new UsernamePasswordAuthenticationToken(
                        userDetails,
                        null,
                        userDetails.getAuthorities()
                );

        SecurityContextHolder.getContext().setAuthentication(auth);

        filterChain.doFilter(request, response);
    }
  }


```
My concern is about database calls.

Since HTTP requests are stateless, this filter runs for every request, and loadUserByUsername() will hit the database every time.

Later inside my controllers/services, if I again need the current user, I usually call my repository method like:

```javascript

  userRepository.findByEmail(email)


```
But this means the database is queried twice for the same user in a single request:

Once inside the JWT filter (loadUserByUsername)

Again in my service layer (findByEmail)

Instead, I could extract the user from the SecurityContext:

```javascript
   Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
   UserDetails userDetails = (UserDetails) authentication.getPrincipal();
  

```
**My questions**

Is it production-safe to reuse the UserDetails stored in the SecurityContext instead of querying the database again?

What is the recommended production approach?

I want to understand what best practices are typically followed in production Spring Security JWT implementations.

Is it safe to reuse UserDetails from SecurityContext instead of querying the database again?

Related Questions

Same Tag Questions

Popular Questions

0 Answers