Why non-thread-safe "session" is used in Catalina filters without synchronization?

Question

In this post on stackoverflow, it is established that HttpSession is not thread-safe. Specifically,

The Developer has the responsibility for thread-safe access to the attribute objects themselves. This will protect the attribute collection inside the HttpSession object from concurrent access, eliminating the opportunity for an application to cause that collection to become corrupted.

However, looking at the implementation of Catalina's CsrfPreventionFilter, I see no synchronization applied:

HttpSession session = req.getSession(false);

@SuppressWarnings("unchecked")
LruCache<String> nonceCache = (session == null) ? null
        : (LruCache<String>) session.getAttribute(
                Constants.CSRF_NONCE_SESSION_ATTR_NAME);


...

if (nonceCache == null) {
    nonceCache = new LruCache<String>(nonceCacheSize);
    if (session == null) {
        session = req.getSession(true);
    }
    session.setAttribute(
            Constants.CSRF_NONCE_SESSION_ATTR_NAME, nonceCache);
}

Could you please explain if this kind of access is safe, and why?

---

Update: In response to Andrew's answer below: Please check the following code. In function process() of ThreadDemo, while req is a local variable, it's not thread-safe, as it holds reference to the shared object session.

import java.util.HashMap;
import java.util.Map;

public class Main {

    public static void main(String[] args) {
        Session session = new Session();
        int len = 10;

        ThreadDemo[] t = new ThreadDemo[len];

        for (int i = 0; i < len; i++) {
            t[i] = new ThreadDemo(session);
            t[i].start();
        }
    }
}

class ThreadDemo extends Thread {
    private final Session session;

    ThreadDemo(Session session) {
        this.session = session;
    }

    @Override
    public void run() {
        Request request = new HttpRequest(session);
        process(request);
    }

    private void process(Request request) {
        HttpRequest req = (HttpRequest) request;
        Session session = req.getSession();

        if (session.getAttribute("TEST") == null)
            session.putAttribute("TEST", new Object());
        else
            session.clearAttributes();

        System.out.println(session.getAttribute("TEST") == null);
    }
}

class Session {
    private final Map<String, Object> session;

    Session() {
        session = new HashMap<>();
    }

    Object getAttribute(String attr) {
        return session.get(attr);
    }

    void putAttribute(String attr, Object o) {
        session.put(attr, o);
    }

    void clearAttributes() {
        session.clear();
    }
}

class Request {
    private final Session session;

    Request(Session session) {
        this.session = session;
    }

    Session getSession() {
        return session;
    }
}

class HttpRequest extends Request {
    HttpRequest(Session session) {
        super(session);
    }
}

Answer 1

From the source

HttpSession session = req.getSession(false);  // line 196

req is local so is thread safe, and if concurrent requests are received where the above session (unique to each thread) results in null, then it's reasonably safe to assume the concurrent requests represent different users (or at least unrelated requests from a single user).

Later, a new session is established (unique to to each thread):

session = req.getSession(true);   // line 217

At this point there is no way for another concurrent request to be related to the above non-null session since the client has not yet received a response so the client does not yet know its session ID to send during a subsequent request.

So it's safe to create the session attribute for the just created session:

session.setAttribute(Constants.CSRF_NONCE_SESSION_ATTR_NAME, nonceCache);  // line 219

Then a response is sent back to the client with the session ID. The next request includes the session ID so

session = req.getSession(true);   // line 217

will not be null. And similarly, nonceCache will not be null so this whole block

if (nonceCache == null) {
    nonceCache = new LruCache<String>(nonceCacheSize);
    if (session == null) {
        session = req.getSession(true);
    }
    session.setAttribute(
        Constants.CSRF_NONCE_SESSION_ATTR_NAME, nonceCache);
}

will be skipped during subsequent requests related to the existing session.

Access to the elements of the cache are synchronized in the nested LruCache class lines 358 and 364.