The spring surf user object does not provide unique instances to web quickstart users. Why is this? If we need to save a piece of data in the user object to preserve it during a session, it is available to all other users.
Do I need to put this private data somewhere else?
The Surf user object is created when you use Surf authentication on the site. The WQS samples don't use authenticated sessions, so the user object is the default global user object which is a shared resource. I suggest that you simply use "normal" JEE session management techniques to store session-specific data.