Does a session-scoped backing bean have to be implemented thread-safe?

Question

Is it possible, that a session-scoped backing bean is accessed by multiple threads at the same time?

The servlet spec says, it is possible:

Multiple servlets executing request threads may have active access to the same session object at the same time. The container must ensure that manipulation of internal data structures representing the session attributes is performed in a thread safe manner. The Developer has the responsibility for thread safe access to the attribute objects themselves. This will protect the attribute collection inside the HttpSession object from concurrent access, eliminating the opportunity for an application to cause that collection to become corrupted.

However I could not make the server (JBoss) use different threads for the same session. When I opened multiple tabs and started a long running request in one tab, and then started a request in another tab, the second tab had to wait for a response until the action started in the first tab was completed.

I also verified this by blocking the thread with a breakpoint in the backing bean. It was not possible to do anything in other tabs of the same session until I resumed the thread.

Despite this we have some strange exceptions in the production log and so far the only possible explanation we have is, that multiple threads concurrently access the same session-scoped backing bean.

Answer 1

Yes, A Servlet session is thread safe . But, if you are putting mutable object in the session. The application should take care of the synchronization.

In your case, if your Bean is Mutable ie, has state. Yes it has to be thread safe. if your Bean is Mutable ie, has state. Yes it has to be thread safe.

And about your test case, it depends on the browser you are using. Most browsers support upto 6 connections in parallel for every server. But, Not sure if they use parallel connections if there have cookies.