I think that will depend on the way HttpSession is implemented in your system. Looking at the Tomcat source code, I see that a Hashtable is used to store data, so you would not need to synchronize simple get and set operations, but you would need to synchronize anything more complex, such as getAttributeNames() To be sure, you should synchronize if your design is such that more than one request will be processed at one time.
Originally posted by William Brogden: To be sure, you should synchronize if your design is such that more than one request will be processed at one time.
Whether more than one request will be processed at one time is not just a matter of design. You cannot stop a user from pressing Refresh. If there's anything in your servlet/JSP which may take some time -- intensive computation, database access -- there is a real chance that a single session may see multiple requests at a time. Moreover, if you've got a site with frames, multiple simultaneous requests are virtually guaranteed. Browsers often open up a couple of connections to load up all the documents in a frameset. - Peter