Avoid SingleThreadModel
ID |
java.servlet_singlethreadmodel |
Severity |
info |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
best-practice, concurrency, reliability |
Rationale
SingleThreadModel was deprecated in Servlet 2.4 and removed in later versions. The interface was intended to guarantee that only one thread at a time would execute a servlet’s service method, but in practice the container may create multiple instances, leaving shared state (static fields, external resources) entirely unprotected. Developers who rely on SingleThreadModel get a false sense of thread safety.
// Bad - deprecated and misleading
public class LegacyServlet extends HttpServlet implements SingleThreadModel {
private int counter; // NOT thread-safe despite the interface
}Remediation
Remove the SingleThreadModel interface and protect shared state explicitly with synchronization or by making the servlet stateless.
// Good - explicit synchronization where needed
public class SafeServlet extends HttpServlet {
private final AtomicInteger counter = new AtomicInteger();
}