FULL PRODUCT VERSION :
1.6.0_26

ADDITIONAL OS VERSION INFORMATION :
Linux myhostname 2.6.38.8-gg621 #2 SMP Wed Sep 14 13:43:05 PDT 2011 x86_64 GNU/Linux

A DESCRIPTION OF THE PROBLEM :
The default implementation of com.sun.net.httpserver.HttpExchange.get/setAttributes is the same as HttpContext's get/setAttributes.

The documentation makes no indication that the HttpExchange attributes are per-context instead of per-exchange.

Looking at sun.net.httpserver.ExchangeImpl in openjdk7, there is code like this:

    public Object getAttribute (String name) {
if (name == null) {
throw new NullPointerException ("null name parameter");
}
if (attributes == null) {
attributes = getHttpContext().getAttributes();
}
return attributes.get (name);
    }


It seems likely that the programmer thought that the Map returned by HttpContext.getAttributes was a copy and not the internal map used by HttpContext (because why else would you need the ExchangeImpl.attributes variable?). Simply creating a new HashMap when assigning to ExchangeImpl.attributes would seem to solve the problem.

The JBoss project seems to have noticed this bug/documentation deficiency and has an alternative version of setAttribute that allows providing a scope. https://github.com/jbossas/httpserver/blob/master/src/main/java/org/jboss/com/sun/net/httpserver/HttpExchange.java

If the code is working as intended and attributes are context-scoped, then the documentation must still be updated to warn the user that external synchronization is required when using HttpExchange.get/setAttribute, since there is no synchronization for multiple HttpExchange's modifying HttpContext's attributes HashMap at the same time.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
In one context for one request:
ex.setAttribute("testing", "value");

In same context during another request:
String value = ex.getAttribute("testing");

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
ex.getAttribute("testing") should return null.
ACTUAL -
ex.getAttribute("testing") returns "value".

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import com.sun.net.httpserver.*;
import java.net.*;

public class HttpExchangeAttributeTest implements HttpHandler {
  @Override
  public void handle(HttpExchange ex) throws java.io.IOException {
    System.out.println(ex.getAttribute("testing"));
    System.out.flush();
    ex.setAttribute("testing",
        "If you see this, then attributes are not exchange-scoped.");
    ex.sendResponseHeaders(200, -1);
    ex.close();
  }

  public static void main(String[] args) throws Exception {
    HttpServer server = HttpServer.create(new InetSocketAddress(0), 5);
    int port = server.getAddress().getPort();

    server.createContext("/", new HttpExchangeAttributeTest());
    server.start();

    URL url = new URL("http://127.0.0.1:" + port + "/");
    URLConnection conn = url.openConnection();
    conn.setDoInput(true);
    conn.connect();
    conn.getInputStream().close();

    conn = url.openConnection();
    conn.setDoInput(true);
    conn.connect();
    conn.getInputStream().close();

    server.stop(0);
  }
}
---------- END SOURCE ----------