I have a design for locking and I wonder if it is correct. It seems so easy. I got the feeling I missed something:
At serverside, there are multiple data objects. There is one static HashMap that contains the locked records. In lock(recNo) I synchronize on the HashMap, lock the record if possible by writing it in the HashMap.
If the cookie is unique, I feel I can execute update and unlock without synchronizing anything. To recover from failure, I catch an InterruptedException and maybe remove the logical lock from the HashMap.