Why should we make a SessionScoped ManagedBean thread safe in JSF?

Question

I know that Application-Scope persists across multiple users, so it's obvious that we should make sure that all the ApplicationScoped ManagedBeans are thread safe.

I also understand that we don't need to care about thread safety for a RequestScoped ManagedBean. That's because it last only for one HTTP request, and is newly instantiated for each request if it's referenced.

But I am not quite sure why we should worry about thread safety for a SessionScoped ManangedBean. Even though it persists across multiple requests, each individual user gets his/her own instance of it, right?

So, why do we need to worry about thread safety in case of SessionScoped ManagedBeand, and does that apply to ViewScoped ManagedBean too? ViewScope persists across 2 consecutive requests for the same view, right?

Answer 1

If you already worry about the threadsafety of the data in a certain scope, then the data most likely belongs in a more narrow scope (i.e. there is a flaw in the high level design). If the data is been put in the right scope, then there's totally no reason to worry about threadsafety. I assume that your beans are designed the right way that they aren't doing any business logic in the getters.

Use the application scope for application wide data/constants, such as dropdown lists which are the same for everyone. Use the session scope for client specific data, such as the logged-in user and user preferences (language, etc). Use the view scope for rich ajax-enabled dynamic views (ajaxbased validation, rendering, etc). Use the request scope for simple and non-ajax forms/presentations.