A Login Recorded Under the Wrong User: The Ghost Left in ThreadLocal
While we were adding an audit log, one login showed up under the wrong name: B logged in, but the record said A. This postmortem traces the ghost to a SecurityContext left behind in ThreadLocal by a filter that never called clearContext() on reused Tomcat threads.