Short answer: request state should not survive into the next, unrelated request, but the state of an unfinished operation sometimes must. The title mixes two different things. One is mutable request data such as who the caller is, what they may do, and what the handler has put in request-local variables. That data should die with the request. The other is the progress of a larger operation that outlasts a single request/response exchange. That state needs an explicit, protected home.
Treating both as “request state” is how servers end up leaking one user’s identity into another user’s call, or losing a half-finished payment when a worker restarts.
As an Amazon Associate I earn from qualifying purchases.
Request state versus work state
Use this distinction to decide where anything lives:
- Request state: current user identity, authorization context, request-local values, per-request globals. Lifetime: one request.
- Reusable infrastructure: connection pools, compiled code, configuration, application definitions. Lifetime: as long as the process or environment, and safe to share because it holds nothing user-specific.
- Work state: the minimum needed to resume a logical operation that has not finished. Lifetime: until the operation reaches a terminal state or expires, held in a deliberate, protected place.
What happens to state after a request ends?
It depends on the platform, and you should not assume either answer. AWS documents that Lambda can freeze an execution environment and later reuse it: objects initialized outside the handler and files in /tmp can remain across invocations, yet environments can also be terminated at any time. See the AWS Lambda execution environment documentation.
#1 Best Overall
That cuts two ways:
- Against treating process memory as durable storage: it may vanish at any moment.
- Against storing mutable request data in module-level or global variables: if the environment is reused, the next invocation may see the previous caller’s values.
Reuse is still valuable for non-user-specific resources such as database clients, which is why they are initialized outside the handler.
Why one request’s state must not bleed into the next
Leakage is a correctness and security bug. If identity or authorization data sits in a process-wide variable and a later request forgets to overwrite it, that request may run with someone else’s rights. The safer design is to give each unit of work an explicit context object, pass dependencies into it, and keep reusable clients separate from per-request identity and user data. One article on this exact question argues for a fresh execution context per unit of work with longer-lived runtime resources and application definitions. That is its proposed design, not a guarantee of every platform; verify how your own runtime scopes request data.
Rank #2
When a logical operation outlasts the request
A single HTTP exchange can end while the operation is unfinished: the server needs more input, the job is slow, or a timeout or restart interrupts it. Then something must survive. The Model Context Protocol proposal SEP-2322 (multi round-trip requests) describes two patterns. It is a project proposal and may change.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallClient-carried continuation
The server returns an opaque requestState. The client sends it back unchanged, along with the required inputs, on a later independent request, and the server continues without having retained anything itself. This suits input collection and brief continuations.
Durable task or workflow record
For work that continues in the background, the server stores a task ID, state and progress. The proposal describes a persistent Tasks workflow for this. AWS documents a comparable managed option, Lambda Durable Functions, with state persistence, checkpointing and progress tracking.
Choosing a pattern
| Pattern | State owner | Good fit | Main trade-off |
|---|---|---|---|
| Fresh request scope | The current execution context | Normal short API handling, user and request data | Simple isolation, but unfinished work must be restarted or handed off explicitly |
| Client-carried opaque continuation | Client carries server-issued state between requests | Input collection, brief continuation, load shedding | Stateless server, but exposure, size, expiry, validation, versioning and user binding all matter |
| Durable server-side task | Server stores task ID, state, progress | Long-running, costly, background or restart-resumable work | Strong recovery and control, but storage, cleanup, access control and orchestration cost |
| Process-local memory or cache | A possibly reused worker | Performance cache, non-user-specific resources | Not durable; reuse varies; mutable request data can leak |
Compare options on six axes: how long the work runs and whether it continues after the response; who owns the state and which instances can read it; recovery from crashes and retries; sensitivity and cross-user isolation; idempotency around side effects; and retention, expiry and operating cost.
Rank #4
Securing state that does survive
The MCP proposal puts it plainly: “Servers MUST always validate that state, as the client is an untrusted intermediary.” For continuation tokens, the practical guidance that follows:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Keep the token opaque to the client and validate it on every receipt.
- Protect it against tampering where appropriate, for example by signing it.
- Bind user-specific state to the authenticated user or tenant so it cannot be replayed by someone else.
- Do not put secrets in a client-visible token unless it is suitably protected.
- Set expiry and version semantics so old tokens fail cleanly after a deploy.
Durable server-side records need the same discipline: an owner, an access-control rule, a retention period and a cleanup job. For tasks, return a stable task identifier, persist progress, define terminal states and expiry, and make cancellation and retry behavior explicit. This is design guidance inferred from the cited documents, not tested outcomes.
Retries and side effects need checkpoints
A timeout does not prove the work failed. If a request may charge a card or send a message, the operation may have completed while the response was lost. Retrying blindly duplicates the effect. Record a durable recovery point so a retry can tell “not done” from “done but response lost”, and use idempotency keys or reconciliation against the external system. The API standard TS-21 on HTTP APIs recommends tracking named recovery points for non-idempotent operations.
Quick Recap
A practical checklist
- List every piece of state your handler touches and label it request, reusable infrastructure, or work state.
- Remove request state from globals; pass an explicit context.
- Initialize shared clients once, outside the handler, with no user data in them.
- For multi-step operations, choose a client-carried token or a durable task record based on duration and sensitivity.
- Validate, expire and user-bind anything that crosses a request boundary.
- Add idempotency keys and checkpoints before any external side effect.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
