Weblogic Subject propagation - Where is subject stored?

Question

Need to understand how subject is stored and propagated in weblogic.

Once authenticated, where is subject stored in HTTP layer ? Internally is it stored in HTTPSession ?

Same way, where is it stored in EJB layer ?

Have an application, where a lot of principals are updated in the subject in HTTP & EJB layer. At some corner cases, getting Concurrent Modification Exception. Although the fix is simple, just to synchronize, Need to understand the internals of where the subject is stored at HTTP & EJB layer.

Forget answering, Is the question clear ? Just want to confirm.

thanks