Spring Security AbstractAuthenticationProcessingFilter扩展丢失实例变量值

Question

Once again, I'm hoping I'm doing something really dumb here. :)

I have an extension of AbstractAuthenticationProcessingFilter in my Spring Security implementation, and in that extension, in the attemptAuthentication method, I access the passed-in HttpServletRequest object and pull out a header value, which I store in an instance variable.

I'm noticing that, sometimes, during a call to another custom method in my project, the value of that instance variable is being null 'd out. It isn't consistent, though.

I can't see any code in my custom method that would be responsible for overwriting the variable, so, I'm trying to narrow things down. I'm hoping it's not something like thread safety that I've overlooked, or some kind of race condition.

Has anyone come across anything like this before?

I'm using Spring 4.1.1 and Spring Security 3.2.5 .

Thanks in advance for any assistance.

Answer 1

The container will only create a single instance of the filter, so having any mutable instance variables is not thread safe. Any concurrent request can cause inconsistent state for your instance variable. You should look into HttpSession .

In response to comment:

It's not so much that you have to use HttpSession, just don't use instance variables in a servlet/filter as they are not thread safe. If you need to maintain state, and you don't want to use sessions, then AFAIK, you'll need to pass client information with every request.