javax.jcr.Session is not a thread safe object.
Thus, never try to share it between threads.
Do not use System session
from the user related code
because a system session has unlimited
from process related code
Session.logout() explicitly to release resources assigned to the
When designing your application, take care of the Session policy inside your application. Two strategies are possible: Stateless (Session per business request) and Stateful (Session per User) or some mixings.