Currently there are significant ambiguities in the servlet specification with regards to how sessions should be distributed:
+ should changes made to the attibute value objects after the setAttribute be reflected in the persisted/distributed state? Is setAttribute pass-by-reference or pass-by-value ?
+ when is a session attribute persisted/distributed? When setAttribute is called? when the current request completes? when all simultaneous requests complete? at regular intervals? on container shutdown?
+ the requirement that only a single instance of a session is active in a cluster is difficult to efficiently implement. Can concurrent instances be allowed?
+ are sessions persisted/serialized attribute by attribute or as a single session blob?