2. Local variables (variables defined in a servlet methods) and request (ServletRequest) attributes are thread safe.
3. If you implement SingleThreadModel interface in a servlet then you can make Servlet Instance variables also thread safe. (In a JSP you implement SingleThreadModel by specifying page directive <%@ page isThreadSafe="false" %>
Yes, the default is true. But, that is assuming that you will take care of actually making it thread-safe. The most appropriate thing to do is synchronize on any process/logic that will make your servlets (including servlets resulting from JSP) NOT thread-safe. (i.e. any logic that can be accessed by more than one thread simultaneously)
Bosun (SCJP, SCWCD)
So much trouble in the world -- Bob Marley