Summary
AbstractSecurityExpressionHandler creates new StandardEvaluationContext instances over and over, thus leading to a performance penalty in WebExpressionVoter that could be avoided imho. See https://jira.spring.io/browse/SPR-16942 and its linked tickets for more information.
Actual Behavior
AbstractSecurityExpressionHandler creates new StandardEvaluationContext instances over and over.
Expected Behavior
EvaluationContext instances are cached and the use of SimpleEvaluationContext is considered (if applicable).
Versions
This affects the 4.2.x mainline, but presumably 5.x as well.
Comment From: jzheaux
Thanks for the report, @dreis2211. AbstractSecurityExpressionHandler currently recreates the context on each evaluation because a SecurityExpressionRoot(Authentication) is the root object and Authentication is a method parameter.
I read the referenced issue and I agree that a context-bound root object would hypothetically address the issue, but I'm not clear on how to achieve that in a thread-safe way in this case. The Authentication method parameter would somehow need to be installed in a thread-safe location that the StandardEvaluationContext accesses.