code: public static Object getSessionMutex(HttpSession httpSession, String attributeName) {
          assert httpSession != null : "HttpSession must not be null";
          assert attributeName != null : "The attribute name must not be null";
  
          Object mutex = httpSession.getAttribute(attributeName);
          if(mutex == null)
              mutex = httpSession;
  
          assert mutex != null;
  
          if(LOG.isDebugEnabled())
              LOG.debug("Using session lock of type: " + mutex.getClass());
  
          return mutex;
      }
docs: Returns a mutex object for the given {@link HttpSession} that can be used
  as a lock for a given session. For example, to synchronize lazy
  initialization of session scoped objects.
  
  <p>The semantics for locking on an HttpSession object are unspecified, and
  servlet containers are free to implement the HttpSession in such a way
  that acquiring a lock on the HttpSession itself is not safe.  When used
  in conjunction with a HttpSessionListener (such as NetUI's
  HttpSessionMutexListener) that puts a mutex object on the session when
  the session is created, this method provides a lock that is 100% safe
  to use across servlet containers. If a HttpSessionListener is not
  registered in web.xml and there is no object for the given attribute name,
  the HttpSession itself is returned as the next best lock.</p>
  
  @param httpSession the current session
  @param attributeName the attribute name of the mutex object on the session
  @return a mutex that can be used to serialize operations on the HttpSession