Spring MVC: how to build a thread-safe Controller

By , last updated July 6, 2019

Controllers in Spring MVC are designed to be shared between requests. Each controller has a default singleton scope so if you are using controllers you need to be aware of that. The easiest way to make sure your controller is thread-safe is to avoid class variables. F.ex. this example from Spring MVC tutorial:

public class EditPetForm {

    private final Clinic clinic;

    public EditPetForm(Clinic clinic) {
        this.clinic = clinic;

    @RequestMapping(method = RequestMethod.GET)
    public String setupForm(@RequestParam("petId") int petId, ModelMap model) {
        Pet pet = this.clinic.loadPet(petId);
        model.addAttribute("pet", pet);
        return "petForm";

    @RequestMapping(method = RequestMethod.POST)
    public String processSubmit(
            @ModelAttribute("pet") Pet pet, BindingResult result, SessionStatus status) {

        new PetValidator().validate(pet, result);
        if (result.hasErrors()) {
            return "petForm";
        else {
            return "redirect:owner.do?ownerId=" + pet.getOwner().getId();

In this example we can have a serious issue regarding thread-safety: private variable clinic. If there is a situation where two different requests access the controller simultaneously, one of them will instantiate the controller and begin to process the form, then the other one comes in. The result from processing of the first request will be sent to the other one, thus the requests receive wrong data or nothing.

The solution to the problem may be the following:
1. Annotate Controller with @Scope(“request”) or @Scope(“session”)
2. Move private variable into one of the methods or save it in session or model.



  1. Alex May 16, 2012 Leave a Reply

    What about properties that are injected by Spring? Are they thread-safe?

    public class PostsController {
    HttpServletRequest request;

    JpaEntityManager models;

  2. Tatyana May 16, 2012 Leave a Reply

    Can’t really see the difference. Singleton means there is only one instance of a class. If two or more clients use it simultaneously, there can be problems.

  3. Deer April 9, 2013 Leave a Reply

    I don’t think that you’re right. Controller is singleton. so the contructor for the controller should be executed just once. and as the code shows that Clinic is final, so anywhere else cann not modify the variable. so i think for this case, it’s thread safe.

    • bnrdo July 18, 2013 Leave a Reply

      final Object doesn’t mean the data of that Object cannot be modified, it only means that the reference for that particular Object cannot be replaced with a new one, so yes he’s right.

  4. tisy April 9, 2013 Leave a Reply

    How about a situation when one request instantiates Clinic with own values and the other one uses it?

  5. Chad J Hamilton May 6, 2016 Leave a Reply

    Thanks, I think this was my problem. I was in a hurry and declared instance variables in my controller classes instead of putting this logic in the service layer…just dumb on my part. I appreciate you putting this out because I was in dire straits.

Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>