With the refactoring in WildFly Clustering and its ConcurrentSessionManager, the concurrent CacheStrategy it employs will skip attempts to lock the session if it is fetched from the references map.  The lock would typically be grabbed by this factory.apply call, but this is only reached if result from the references map was originally null.

This causes a significant change in behavior for prior configs like below where the session was previously locked for every request, preventing concurrent access and modifications to the session:

                <distributed-cache name="dist">
                    <locking isolation="REPEATABLE_READ"/>
                    <transaction mode="BATCH"/>
                    <expiration interval="0"/>
                    <file-store passivation="true" purge="true"/>
                </distributed-cache> 

Now that the lock can be skipped, concurrent session modifications are no longer prevented and bad session states can be seen across concurrent requests.