Page History

...

Thread pools allow a system to limit the maximum number of simultaneous request requests that it processes to a number that it can comfortably serve, rather than terminating all service services when presented with a deluge of requests. Thread pools overcome these issues by controlling the maximum number of worker threads that will can execute concurrently. Each object that supports thread pools accepts a Runnable or Callable<T> task and stores it in a temporary queue until resources become available. Additionally, thread life-cycle management overhead is minimized because the threads in a thread pool can be reused and can be efficiently added to or removed from the pool.

Programs that use multiple threads to serve requests should — and security-sensitive programs must — ensure graceful degradation of service during traffic bursts. Use of thread pools is one acceptable approach to meeting this requirement.

Noncompliant Code Example (Thread-Per-Message)

This noncompliant code example demonstrates the Thread-Per-Message design pattern. The RequestHandler class provides a public static factory method so that callers can obtain its instance. The handleRequest() method is subsequently invoked to handle each request in its own thread.

...

The Thread-Per-Message strategy fails to provide graceful degradation of service. As threads are created, processing continues normally until some scarce resource is exhausted. For example, a system may allow only a limited number of open file descriptors, even though additional threads can be created to serve requests. When the scarce resource is memory, the system may fail abruptly, resulting in a denial of service.

Compliant Solution (thread pool)

This compliant solution uses a fixed- thread pool that places ana upperstrict boundlimit on the number of concurrently executing threads. Tasks submitted to the pool are stored in an internal queue. This prevents the system from being overwhelmed when attempting to respond to all incoming requests and allows it to degrade gracefully by serving a fixed maximum number of simultaneous clients \[[Tutorials 2008|AA. Bibliography#Tutorials 08]\].

...

...