Well, what is a "local object"? A local object is not an object reference held in a local variable, but an object which is only locally reachable. The object referred to by the sessionMap variable is session-scoped, i.e. bound as an HttpSession attribute. This makes it non-locally reachable. Because a single session may easily experience multiple simultaneous requests -- each of which probably gets its own thread -- the object is (in principle) not safe against multi-threaded access. Multiple concurrent requests for the same session are a common occurrence with frames, dynamically rendered graphics or other embedded/included page elements, users with no patience for servers under load, etc. - Peter [ April 13, 2002: Message edited by: Peter den Haan ]