Understanding Spring Controller Bean Scope: Singleton vs Prototype and Thread Safety

In Spring MVC, a controller is a singleton bean by default, which means it is shared across all requests and is not thread‑safe if it holds mutable instance variables.

To illustrate the problem, the following code defines a controller with a non‑static int num field and two request mappings:

package com.riemann.springbootdemo.controller;

import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

/**
 * @author riemann
 * @date 2019/07/29 22:56
 */
@Controller
public class ScopeTestController {

    private int num = 0;

    @RequestMapping("/testScope")
    public void testScope() {
        System.out.println(++num);
    }

    @RequestMapping("/testScope2")
    public void testScope2() {
        System.out.println(++num);
    }

}

When the endpoint /testScope is called first, the output is 1 . A subsequent call to /testScope2 prints 2 , showing that the same controller instance is reused and the mutable field is shared, which is unsafe in a multithreaded environment.

To make the controller prototype‑scoped, the @Scope("prototype") annotation is added:

package com.riemann.springbootdemo.controller;

import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

/**
 * @author riemann
 * @date 2019/07/29 22:56
 */
@Controller
@Scope("prototype")
public class ScopeTestController {

    private int num = 0;

    @RequestMapping("/testScope")
    public void testScope() {
        System.out.println(++num);
    }

    @RequestMapping("/testScope2")
    public void testScope2() {
        System.out.println(++num);
    }

}

With prototype scope, each request receives a new controller instance. Calling /testScope prints 1 , and a subsequent call to /testScope2 also prints 1 , confirming that the state is not shared.

Solution

Do not define mutable member variables in a controller.

If a member variable is necessary, declare the controller with @Scope("prototype") to obtain a new instance per request.

Alternatively, use a ThreadLocal variable inside the controller to keep data isolated per thread.

Additional Explanation of Spring Bean Scopes

Spring defines five main bean scopes:

singleton : a single instance per Spring ApplicationContext . It is created eagerly unless lazy-init is used.

prototype : a new instance is created each time the bean is requested from the container; Spring does not manage its full lifecycle after creation.

request : a new instance for each HTTP request, specific to web applications.

session : a new instance for each HTTP session.

globalSession : a global session scope, similar to the servlet application scope.