The principal is actually the currently logged in user.

You can retrieve security context which is bound to the current thread and as such it's also bound to the current request and its session. 

The SecurityContextHolder.getContext() internally obtains the current SecurityContext implementation through a ThreadLocal variable.

Because a request is bound to a single thread this will get you the context of the current request.

​

Read more: https://javarevisited.blogspot.com/2021/02/spring-security-interview-questions-answers-java.html#ixzz7oQ8qjzcc