Servlet JSP thread Learning

When compiling Servlet JSP, the Servlet JSP thread security issue is easily overlooked. If you ignore this issue, your program may have potential risks.

1. Servlet Lifecycle

The Servlet lifecycle is the responsibility of the Web Container. When the client requests the Servlet for the first time, the container initializes the Servlet, that is, instantiates the Servlet class. In the future, this instance will be responsible for client requests. Generally, other Servlet classes will not be instantiated, that is, multiple threads are using this instance. Servlet is more efficient than CGI because Servlet is multi-threaded. If the Servlet is declared as a single-threaded model, the container maintains an instance pool and multiple instances exist.

2. Servlet thread security

The Servlet specification has declared that Servlet is NOT thread-safe, so you should note this issue when developing Servlet. Here we use a realistic model to illustrate the problem. First we define a Servlet class, and then a SmulateMultiThread class and WebContainer class.

 

  
Importjavax. servlet. http. HttpServlet;
  
Importjavax. servlet. ServletException;
  
Importjavax. servlet. http. HttpServletRequest;
  
Importjavax. servlet. http. HttpServletResponse;
  
Importjava. io. IOException;
  
// This class simulates the multi-thread Servlet situation
  
PublicclassSmulateMultiThreadimplementsRunnable {publicSmulateMultiThread (){
  
}
  
Publicstaticvoidmain (String [] args ){
  
// Process 100 requests (Inti=0; I<100; I ++ ){
  
NewThread (newSmulateMultiThread (). start ();
  
}
  
}
  
Publicvoidrun (){
  
HttpServletRequestrequest=Null;
  
HttpServletResponseresponse=Null;
  
Try {
  
WebContainer. getServlet (). doGet (request, response );
  
}
  
Catch (IOExceptionex ){
  
}
  
Catch (ServletExceptionex ){
  
}
  
}
  
}
  
// This is a Servlet class classUnsafeServletextendsHttpServlet {
  
PrivateStringunsafe; publicvoidinit () throwsServletException {
  
}
  
// ProcesstheHTTPGetrequestpublicvoiddoGet (HttpServletRequestrequest,
HttpServletResponseresponse) throwsServletException, IOException {
  
Unsafe=Thread. CurrentThread (). getName ();
  
System. out. println (unsafe );
  
}
  
}
  
// This is the container class classWebContainer {
  
PrivatestaticUnsafeServletus=NewUnsafeServlet();
  
PublicstaticUnsafeServletgetServlet () {returnus;
  
}
  
}
 

Output 100 different thread names. If 100 requests are processed by this Servlet at the same time, unsafe may have 100 types of de-value, and the client will get an error value. For example, the thread name requested by client 1 is thread-1, but the returned value may be thread-20. In reality, the user name I log on to is user1, Which is changed to user2.

So how can we ensure Servlet security? If multiple threads can be shared, do not use it (instance variables + class variables. You can also use the synchronized synchronization method, but the efficiency is not high. You can also use a single-threaded model, which is less efficient. When 100 requests come at the same time, you need to instantiate 100 instances.

The temporary variables in the method do not affect thread security because they allocate space on the stack and each thread has its own private stack space.

3. Servlet JSP thread security

JSP is essentially a Servlet. All JSP security problems should be easily understood as long as you understand the Servlet security issues. The declared variables are Servlet instance variables, not thread-safe. Others are thread-safe.

Summary: Servlet JSP threads are mainly caused by instance variables. Do not use instance variables in Servlet, JSP, or Struts actions. Do not use instance variables in any method, your program is thread-safe.

1. JSP development technical application details
2. Detailed description of JSP development environment Configuration
3. JScript, Java, JavaScript, and JSP Summary
4. Detailed description of JSP development environment Configuration
5. ASP and JSP comparison