Core scopes:
- singleton (default): one instance per Spring container. Use for stateless services, repositories and controllers. Beans must be thread-safe because all requests share them.
- prototype: a new instance every time the bean is requested. Use for stateful, short-lived objects. Spring does not manage the full lifecycle, so destroy callbacks are not called.
Web scopes (web-aware context only):
- request: one instance per HTTP request, for request-level state such as a correlation id.
- session: one per HTTP session, for user session data such as a shopping cart.
- application: one per ServletContext.
- websocket: one per WebSocket session.
Common pitfall: injecting a prototype or request-scoped bean into a singleton. The singleton is created once, so it keeps the same instance forever. Fixes:
- @Scope(value = "request", proxyMode = ScopedProxyMode.TARGET_CLASS) so a proxy resolves the right instance per call.
- ObjectProvider or @Lookup methods to fetch a fresh instance when needed.
Interview tip: tie the choice to state. Stateless means singleton; per-request or per-user state means a narrower scope with a proxy.