Ok true 👍 And I was wrong, ContextWebFilter is for incoming and ExchangeFilterFunction for the outgoing requests via WebClient. However, the Reactor/Security Context (also GRAPHQL_CONTEXT_KEY) is not present there. The requests outside of graphq-kotlin handling have a populated Context. The Problem is also there outside of the FilterFunction. Using:

val reactorContext =
    coroutineContext[ReactorContext]?.context

in a resolver function won't return the context

problem is due to the reliance on graphql-java….

True, I noticed when inspeciting the parent contexts

i.e. reactor (router) -> coroutine (handler) -> completable future (graphql-java) -> coroutine (resolvers)