Yes, I am using <distributable/> in my web.xml though I am not using any jboss-web.xml. I think i have used the wrong term "merged" . I should have been specific which is your 2nd statement "I can imagine 2 users ending up with the same session id, and thus one user seeing the others data (but none of their own.)" This might be possiblity that user getting same session id and ending up seeing other's user data. Even i never heard or seen this kind of problem. I tried to replicate the problem at my end but I was getting all correct information on next page, I mean on 2 different mahchines i tried to submit data at the same time and i was getting 2 different session ids. Would it help if i put session.invalidate() at the end, where application finish processing. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4114858#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...