This is not correct as it breaks the filter thread safety. We should not put such private fields into the filter as filter is managed in the Singleton scope (JAX-RS providers are by default singletons). So, there is one filter per client and it can be handling many requests in the same time. Therefore it must be thread safe.

So, the variables must be at least "volatile". However, this would not be enough in this case.

The request state information must be managed in other way. In jersey 1.x we kept the following information in "State" private class which was kept in the ThreadLocal. This approach cannot be used in Jersey 2.x as it offers async support and we cannot rely on the fact, that one thread will handle all requests (event the response can be handled by different thread). Maybe we can store information for example in the request properties or in the private map which will have request as a key. I will have to spent more time to find the best working approach for this case. Or we can store it like that but additional synchronization will be needed.