Appropriate Session Locking

Question

Our site framework creates a User.cfc object and assigns it
to the session variable SESSION.User. The User object has all the
usual CRUD methods plus instance variables for if the user is
logged in and various other account flags. The object is created in
the Application.cfc onRequestStartMethod() and is wrapped in a
session lock tag. When a user logs in, the
SESSION.User.UserLogin(useranme,password) method is called, the db
lookups are made, all the instance variables are set, so forth.
Then, all over the site various methods such as
SESSION.User.GetUserID() and SESSION.User.IsUserLoggedIn() are
called for specific actions.For instance, a form post to update an
email address would be SESSION.User.SetEmail(FORM.Email) and then
SESSION.User.SaveUser(). Logging out of the system just clears the
session struct and sets the SESSION.User var to a fresh instance of
the User.cfc.
My question is it is safe to be making calls to the
SESSION.User methods without locking the session scope. I've never
had an issue with memory or race conditions before but a recent
server move and increased traffic has caused some unexplained
results. Just trying to narrow the problem down and am wondering
about best practices in user of objects stored in the SESSION
scope.
Anthony

Answer 1

I set the session like this:
<cffunction name="onSessionStart" returnType="void"
output="false">
<cflock scope="session" timeout="20" >
<cfset StructClear(session)>
<cfset SESSION.User =
CreateObject("component","lib.UserObject")>
<cfset SESSION.Company =
CreateObject("component","lib.CompanyObject")>
</cflock>
</cffunction>
And then yes, I just call SESSION.User.GetUserID() or any
other method as appropriate.
I'm just wondering if any memory or race conditions could
occur if calling the get/set methods of SESSION.User with out
locking it. Is it enough to just lock the assignment of the User
cfc to the SESSION scope.