在SpringSecurity6中，默认行为是SecurityContextHolderFilter将只从SecurityContextRepository读取SecurityContext并将其填充到SecurityContextHolder中。如果用户希望SecurityContext在请求之间保持不变，则现在必须显式地将SecurityContext与SecurityContextRepository一起保存。这通过只需要写入SecurityContextRepository来消除歧义并提高性能（即HttpSession）在必要时。

SecurityContextHolder.setContext(securityContext);
securityContextRepository.saveContext(securityContext, httpServletRequest, httpServletResponse);

请访问https://docs.spring.io/spring-security/reference/5.8/migration.html#_explicit_save_securitycontextrepository
如果不起作用，请尝试返回到5.x默认设置：

http
    .securityContext((securityContext) -> 
            .requireExplicitSave(false)
    )

我改变了一些代码如下，但仍然不工作。

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
    // Get authorization header and validate
    final String header = request.getHeader(HttpHeaders.AUTHORIZATION);

    if (isEmpty(header) || !header.startsWith("Bearer ")) {
        chain.doFilter(request, response);
        return;
    }

    // Get jwt token and validate
    final String token = header.split(" ")[1].trim();

    if (!jwtTokenUtil.validate(token)) {

        chain.doFilter(request, response);

        return;
    }

    // Get user identity and set it on the spring security context
    UserDetails userDetails = jpaUserDetailService.loadUserByUsername(jwtTokenUtil.getUsername(token));

    UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, (userDetails == null ? null : userDetails.getAuthorities()));

    authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));

    SecurityContextImpl scix = new SecurityContextImpl(authentication);

    SecurityContextHolder.setContext(scix);

    RequestAttributeSecurityContextRepository securityContextRepository = new RequestAttributeSecurityContextRepository();

    securityContextRepository.saveContext(scix, request, response);

    chain.doFilter(request, response);
}

配置如下：

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

    http.cors().and().csrf().disable()
        .exceptionHandling().authenticationEntryPoint(jwtAuthenticationProvider)
        .and()
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
        .authorizeHttpRequests((requests) -> requests
                .requestMatchers("/swagger-ui", "/rest-api-docs").permitAll()                   
                .anyRequest().authenticated()
        )

        .addFilterBefore(jwtTokenFilter, UsernamePasswordAuthenticationFilter.class)
        .securityContext((securityContext) -> 
            securityContext.requireExplicitSave(false)
        )
        ;

    return http.build();
}