Consider a user making multiple requests at the same time, do I have to lock all code that works with the Session?
If for example I have the following scenario, where in
Yes, Session is thread-safe.
There's no need to lock anything. However, the need to check the values never cease to be essential.
Update
Check @Peter Ruderman's answer :)
I will have the decency of not copying it :)