FAQ: Should I synchronize the access to the HttpSession object?

No, from the Servlet spec 2.5 and upper but you should take care of the objects put on the session in a thread safe manner.