根据Java，此方法线程安全吗？

Question

If two threads are accessing this method on server, will it be thread safe? The threads are coming from GWT timer.

public UserDTO getUserFromSession()
{
        UserDTO user = null;
        HttpServletRequest httpServletRequest = this.getThreadLocalRequest();
        HttpSession session = httpServletRequest.getSession();
        Object userObj = session.getAttribute("user");
        if (userObj != null && userObj instanceof UserDTO)
        {
            user = (UserDTO) userObj;
        }
        return user;
}

Answer 1

A method is thread safe if it doesn't access to external (to the method) shared variables.

The problem in your code could be on that line of code:

HttpServletRequest httpServletRequest = this.getThreadLocalRequest();

because this.getThreadLocalRequest() seems to access a shared variable. To be sure post the whole class, but for what I can see it is not thread safe .

---

Also after the comment that explain what getThreadLocalRequest method returns a HttpServletRequest safely the code remains not thread safe.

Infact HttpSession is not thread safe according to this article : basically the session can change during the code execution. For example you can return the user also after an invalidation of the session. Imagine this steps:

thread 1                                                thread 2
----------------------------------------------          --------------
Object userObj = session.getAttribute("user");

                                                        session.invalidate();

if (userObj != null && userObj instanceof UserDTO) {
    user = (UserDTO) userObj;
}
return user;    

At the end you return a user also if the session was invalidated by another thread.

Answer 2

This method in of itself is harmless. It would be harmless even if you did not have a thread local request. The only problem with it I see is the off case in which you retrieve attribute "user" while it is instantiated, and another thread wipes attribute "user" clean before the first thread can exit the method. You'd be dealing with a user instance in one thread and in the other, you might be performing logic differently due to the fact that "user" attribute is no longer defined.

That said, I sincerely doubt that any problems would arise since these are all methods that read and don't write with no side effects. Just be mindful of the fact that several threads could be (and probably will be) handling the same instance of user so you'll want to keep thread-sensitive operations on user under a synchronized block in that case.

Answer 3

Yes, it is threadsafe as far as only your given method is concerned. getThreadLocalRequest() is local to your current thread and getSession() is threadsafe as well. Even getting the userObj from the session should not cause issues.

But after all multiple calls could access the same UserDTO object. Therefore you need to make sure that either possible changes in this object are done in a threadsafe way or that the object is immutable.

Answer 4

the method looks threadsafe but it isn't, but in a more subtile way:

While getSession() and Session is safe, the session and its contents are not.

The Session you were looking for can go away anytime. It is not enough to examine only this method, but all other session dependent objects as well.

In a high load situation, you need to take care, that your getuser function will not recreate the session on the fly.

getSession(false) will take care of this. You will have a null check on the Session returned and abort your call in that case.

The user object as stated by others before is another responsibility.