Hi,
I'm a little confused by the following paragraph:
"The effect of implementing SingleThreadModel is virtually the same as synchronizing the service method. Both can bring a web app to its knees without protecting the session and context state."
As STM synchronizes the service method, so isn't it quite obvious that it'll also synchronize the state of session and context attributes from multiple threads. So why is it not going to help in implementing the STM interface in the servlet class?
You can still have other threads accessing and modifying the session and/or context from another servlet or page. The particular STM-servlet is safe but most likely you've got more than only this servlet in your web application.
Any attribute of your STM servlet has to be set at the beginning of the service method and they will not be changed during the whole request.
But, there is no guarantee that the attributes will be the same in the next request from the same user.
That is what they mean with "without protecting the session and context state".