Hi,

On Mon, Sep 4, 2017 at 11:17 AM, Martin Kouba <mkouba@redhat.com> wrote:
Well, it works similar to how @Dependent stateless session beans work.
Unlike @RequestScoped there is no real CDI context just a special proxy
that delegates to SPI.

Indeed, it can't be really request scope, since the principal can potentially change many times during a request. Though, once initially set it normally applies for the remainder of the web request. For other usages of the request scope it's not so well defined in EE actually.

Talking about this build-in bean though, wouldn't it be a good idea to let JSR 375 take ownership of it? The CDI spec before proposed to the servlet spec to take ownership of the build-in beans for the Servlet owned artefacts (such as HttpServletRequest).

Kind regards,
Arjan Tijms