springMVC Controller handles all concurrency issues a user request
State and non-state object basic concepts of
stateful objects (Stateful Bean), the object is to have an instance variable, you can save the data, not thread-safe. Generally prototype scope.
Stateless object (Stateless Bean), is no instance variables of an object, can not save the data, is the same class, are thread-safe. Generally singleton scope.
As in the Action Struts2, if the internal variables instance User, when a user calls the new method, user is used to save the data, then the action is the state of the object. It will result in inconsistent user variables when multiple threads access this action. Therefore, the scope for action designed to prototype, or, User classes into threadLocal in random string to keep multiple threads does not cause User variables (such a scenario is not necessary to put in the threadLocal).
Service generally only the internal variables are as userDao dao instance, is stateless because userDao object (instance variables and no internal data can not be saved), the service object is stateless.
For those singleton class runs in a multi-threaded
Local variables are not affected by the impact multithreading,
member variables will be multi-threaded affected.
The same method more than one thread calls the same object:
If the method where no member variables, are not affected;
if there are members of the variable method, only read operations, are not affected; there is a write operation, consider the impact of multi-threaded value;
Such as Web applications Servlet, each method of operation of the local variables is done in the thread its own memory area, it is thread-safe.
For the operating member variables can be used to ensure ThreadLocal thread safety.
springMVC in general Controller, service, scope DAO layer are Singleton;
Each request is a separate thread, even if simultaneous access to the same Controller object because the object does not modify the Controller, the equivalent for the purposes of Controller object, just read, not write, do not need to synchronize.
Service layer, Dao layer with the default singleton on the line, although the Service class has such a property dao, but dao these classes are no status information, which is equivalent to the same (immutable) class, it does not affect.
Struts2 in Action because there User, BizEntity such instance of an object, there is state information in a multi-threaded environment is unsafe, so Struts2 default implementation Prototype mode. In Spring, Struts2 of Action in scope to be dubbed prototype scope.
Spring concurrent access thread safety issues
由于Spring MVC默认是Singleton的，所以会产生一个潜在的安全隐患。根本核心是instance变量保持状态的问题。这意味着每个request过来，系统都会用原有的instance去处理，这样导致了两个结果：
一是我们不用每次创建Controller，
二是减少了对象创建和垃圾收集的时间；
由于只有一个Controller的instance，当多个线程同时调用它的时候，它里面的instance变量就不是线程安全的了，会发生窜数据的问题。
当然大多数情况下，我们根本不需要考虑线程安全的问题，比如dao,service等，除非在bean中声明了实例变量。因此，我们在使用spring mvc 的contrller时，应避免在controller中定义实例变量。
有几种解决方法：
1、在控制器中不使用实例变量
2、将控制器的作用域从单例改为原型，即在spring配置文件Controller中声明 scope="prototype"，每次都创建新的controller
3、在Controller中使用ThreadLocal变量
这几种做法有好有坏，第一种，需要开发人员拥有较高的编程水平与思想意识，在编码过程中力求避免出现这种BUG，而第二种则是容器自动的对每个请求产生一个实例，由JVM进行垃圾回收，因此做到了线程安全。
使用第一种方式的好处是实例对象只有一个，所有的请求都调用该实例对象，速度和性能上要优于第二种，不好的地方，就是需要程序员自己去控制实例变量的状态保持问题。第二种由于每次请求都创建一个实例，所以会消耗较多的内存空间。
所以在使用spring开发web 时要注意，默认Controller、Dao、Service都是单例的
ThreadLocal和线程同步
ThreadLocal和线程同步机制都是为了解决多线程中相同变量的访问冲突问题。
在同步机制中，通过对象的锁机制保证同一时间只有一个线程访问变量。这时该变量是多个线程共享的，使用同步机制要求程序慎密地分析什么时候对变量进行读写，什么时候需要锁定某个对象，什么时候释放对象锁等繁杂的问题，程序设计和编写难度相对较大。
而ThreadLocal则从另一个角度来解决多线程的并发访问。ThreadLocal会为每一个线程提供一个独立的变量副本，从而隔离了多个线程对数据的访问冲突。因为每一个线程都拥有自己的变量副本，从而也就没有必要对该变量进行同步了。ThreadLocal提供了线程安全的共享对象，在编写多线程代码时，可以把不安全的变量封装进ThreadLocal。
缺点：threadlocal变量会一直存在于controller对象中，但是controller对象是多线程复用的，如果这一次请求完成之后忘记把threadlocal中的信息清空，则在处理下一个请求时则会出现信息串用。
概括起来说，对于多线程资源共享的问题，同步机制采用了“以时间换空间”的方式，而ThreadLocal采用了“以空间换时间”的方式。前者仅提供一份变量，让不同的线程排队访问，而后者为每一个线程都提供了一份变量，因此可以同时访问而互不影响。
https://blog.csdn.net/config441002/article/details/52084156