SWF action beans and class variables safety

[Etienne Dysli Metref]

Hi devs,

Is it [thread-]safe to store request-dependent state in class variables,
where the class extends net.shibboleth.idp.profile.AbstractProfileAction
and the state is used in both doPreExecute() and doExecute()?

This popped in my mind during a recent IdP extension code review, where
class variables -- for example containing a username -- appeared in a
few of our action beans extending one of the subclasses of
AbstractProfileAction. I don't remember the exact guarantees provided by
SWF or the contract for IdP extensions so I'm reaching out to you
guys... Can one action bean instance be used by multiple threads
(provided it has scope=prototype)? If thread execution were suspended
between doPreExecute() and doExecute() that would create a race
condition. Or is it always one HTTP request -> one thread -> one action
instance?

So far, I don't remember using class variables in actions to store
state, only for collaborators like lookup functions, and always pulling
state out of the passed PRC.

Cheers,
  Etienne

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20190329/1fe66731/attachment.sig>