Till today I was thinking "request" and "response" objects are thread safe, because Servlet creates these object for every new request. Even "Head First" series says "request" and "response" objects are thread safe. But today when I am reading Servlet Specs "SRV2.3.4", I found that they are not thread safe.
The thread-safety HFJS etc. are talking about, refers to the multiple threads the container creates (one for each request).
The specs refer to the scenario where the thread of one request, creates another thread. If that new thread (that is not created by the container) accesses the Request or Response object from the first thread, at the same time the first thread does, then problems can occur.