i've read some articles about using long term hibernate session and disconnect() at end of each http request. But is this thread safe? if client sends two request using same httpsessionid (e.g. user opens two browser window), there is racing condition in sharing the hibernate session.
According to doc, hibernate session is not thread safe.

You can avoid this issue by session <-> thread relation as 1:1

you mean 1:1 for hibernate session <-> tomcat thread? That is a typical "hibernate-session-per-http-request" model. Tthe "hibernate-session-per-http-session" is useless?

I am not sure, why it is necessary to bring hibernate session to the web(servlet) Layer. If Data Access layer is designed properly , there is no need to bring hibernate session in the weblayer.