Improve AbstractSecurityExpressionHandler performance

[dreis2211]

Summary

AbstractSecurityExpressionHandler creates new StandardEvaluationContext instances over and over, thus leading to a performance penalty in WebExpressionVoter that could be avoided imho. See https://jira.spring.io/browse/SPR-16942 and its linked tickets for more information.

Actual Behavior

AbstractSecurityExpressionHandler creates new StandardEvaluationContext instances over and over.

Expected Behavior

EvaluationContext instances are cached and the use of SimpleEvaluationContext is considered (if applicable).

Versions

This affects the 4.2.x mainline, but presumably 5.x as well.

[jzheaux]

Thanks for the report, @dreis2211. AbstractSecurityExpressionHandler currently recreates the context on each evaluation because a SecurityExpressionRoot(Authentication) is the root object and Authentication is a method parameter.

I read the referenced issue and I agree that a context-bound root object would hypothetically address the issue, but I'm not clear on how to achieve that in a thread-safe way in this case. The Authentication method parameter would somehow need to be installed in a thread-safe location that the StandardEvaluationContext accesses.