Thanks for the reply. In the various servlets making up this application, I don't currently have a user object in every request but tend to use request.getRemoteUser() where necessary. This also to minimizes traffic. But what you've suggested is good.