Java theory and practice: Are all stateful Web applications broken?

Java theory and practice: Are all stateful Web applications broken?
HttpSession and friends are trickier than they look

The session state management mechanism provided by the Servlets framework, HttpSession, makes it easy to create stateful applications, but it is also quite easy to misuse. Many Web applications that use HttpSession for mutable data (such as JavaBeans classes) do so with insufficient coordination, exposing themselves to a host of potential concurrency hazards.

Link