Servlet Session data being shared

Question

I have a bunch of servlets tha basically generate reports. The problem I'm having is that when two users run the same servlet at about the same time, one of the reports will be over written by the data of the other report. It almost seems that the users are sharing the same context.
Is there any way to fix this or do you have ny suggestions, tips as to how to prevent this.
Thnaks in advance for any help you may provide.

Answer 1

I ran into a similar problem not to long ago with sessions. I had an instance or global reference to the session object in my servlet. When two or more people used the servlet at just the right time I would get problems where data was getting used across sessions. For example:
public class FooServlet extends HttpServlet
     HttpSession session;
     doGet(HttpServletRequest req, HttpServletResponse res)
          session = req.getSession(false);
          doStuffWithSessionData();
     doStuffWithSessionData()
          String temp = session.getValue("temp");
          //do some stuff
}So, person A would connect to the servlet, and their session would be retreived, and the instance reference would get set to their session. Person B would connect at about the same time, their session would get retreived and the instance reference would get set to theirs... right before the getValue("temp") on person A's session is called. So, whatever I was doing for person A would end up using the data out of person B's session. I like to call this a race condition.
It is important to keep in mind that servlets are accessed by multiple threads concurrently, so you need to make sure your servlets are thread safe. Instance variables that get modified with each request are a very bad, non-thread safe thing and will cause odd behaviour like what you are describing. I speak from experience.
I fixed the above by removing the instance reference and doing the following:
public class FooServlet extends HttpServlet
     doGet(HttpServletRequest req, HttpServletResponse res)
               doStuffWithSessionData(req);
     doStuffWithSessionData(HttpServletRequest req)
          HttpSession session = req.getSession(false);
          String temp = session.getValue("temp");
          //do some stuff
          //NOTE: this works most of the time. However, if the client
          //connects with more than one browser window using the same
          //session, I could run into some trouble here too.
}That was a quick fix. However, what I really need to do is create a separate class to encapsulate all user session data and access the session and all data through public static synchronized methods on that class, passing it the request object when I do it. That way all data is stored in one object, and that object is used to do all session access in a thread-safe, synchronized manner.
I hope this information helps you and is understandable. If you have any questions I will try to clarify. Making things thread-safe can be a daunting task.