FYI - This implementation is not compatible with distributed web applications. Specifically, a reference to the HttpSession object is not guaranteed to be valid outside the context of a request, since the container is allowed to passivate/migrate a session at any time which would render these references invalid.