Are implicit objects in JSP are thread safe?

It's important to note, though, that if you store objects in the application, session, request or page contexts, they are not guaranteed to be thread safe. The response and exception objects are created for the current thread and therefore they are safe.

Although the request and page objects themselves are threadsafe, objects stored in them are only safe if they are not also used by other threads. Remember that one of these contexts only stores a reference to an object, not a separate copy of it.

For example, if you create a completely new object in the method, and place it in the request context, it will be threadsafe:

<%
  String name = new String("Kevin");
  request.setAttribute("user", name);
%>

If you use an existing object which is also present in one of the unsafe contexts (application or session), it will not be threadsafe:

<%
  String name = (String)session.getAttribute("name");
  request.setAttribute("user", name);
%>

If you use an existing object which is a static (class) or member (instance) variable in the servlet class, it will not be threadsafe:

<%!
  String name = (String)session.getAttribute("name");
%>
<%
  request.setAttribute("user", name);
%>