In general Servlet/JSP are not thread safe.
Following are the guidelines:
1. Application (ServletContext) attributes, session(HttpSession) attributes,
Servlet Instance variables and Servlet class variables are "not" thread safe.
2. Local variables (variables defined in a servlet methods) and request (ServletRequest) attributes are thread safe.
3. If you implement SingleThreadModel interface in a servlet then you can make Servlet Instance variables also thread safe. (In a
JSP you implement SingleThreadModel by specifying page directive <%@ page isThreadSafe="false" %>
Note: SingleThreadModel interface is deprecated in Servlet API 2.4.
Alankar Yannam