Best of Servlet Thread Safety:-

Servlet Concurrency:-

Servlet concurrency/synchronization in Tomcat?

http://stackoverflow.com/questions/1528214/servlet-concurrency-synchronization-in-tomcat

for more details look in below website:-

http://tutorials.jenkov.com/java-servlets/servlet-concurrency.html

Detailed Thread-Safety Questions concerning Java Servlets

1. Your understanding is correct. Actually thread is created for each request. So HttpServletRequest and HttpServletResponse are local to thread. So no sharing of these two. You do not need to synchronize them. HttpServletRequestWrapper and HttpServletResponseWrapper are the classes which provide a convenient implementation of the HttpServletRequest and HttpServletResponse interfaces respectively. You do not need to worry about them in synchronization context.
2. Definitely you have to provide synchronization for ServletContext object returned by getServletContext() because it is shared between servlets in your application.
3. As HttpServletRequest is local to thread created by container to serve the request. So cookies are also local to that thread and those are not shared. So no need to provide synchronization to cookies.

Few concepts :

1. Servlets are always singlton in your application. i.e. only one object is created.
2. For each request a different thread is created(actually obtained from Thread Pool). Following things are local to thread : HttpServletRequest, HttpServletResponse

Reference:-

http://stackoverflow.com/questions/12106283/detailed-thread-safety-questions-concerning-java-servlets