getSession() thread-safe? User A can see user B's account

[Dave]

Is the following method thread-safe?  After authenticated, a user info is put into session,  when logout, call session.invalidate();

 

The way to get session:  is it thread-safe?

 

  public static HttpSession getHttpSession(boolean create) {
    FacesContext context = FacesContext.getCurrentInstance();
    return (HttpSession)context.getExternalContext().getSession(create);
  }

 

Current symptom is: a user info gets into another user's session. So sometimes User A can see User B's info.

 

If a user clicks two buttons at the same time(two requests belong to one same session), will it be thread-safe?

 

Thanks for help.

---

Do you Yahoo!?
Next-gen email? Have it all with the all-new Yahoo! Mail Beta.