diff --git a/core/src/main/java/org/apache/struts2/interceptor/I18nInterceptor.java b/core/src/main/java/org/apache/struts2/interceptor/I18nInterceptor.java
index 4d3bdf079..da7c6b72f 100644
--- a/core/src/main/java/org/apache/struts2/interceptor/I18nInterceptor.java
+++ b/core/src/main/java/org/apache/struts2/interceptor/I18nInterceptor.java
@@ -221,7 +221,8 @@ public class I18nInterceptor extends AbstractInterceptor {
         Map<String, Object> session = invocation.getInvocationContext().getSession();
 
         if (session != null) {
-            synchronized (session) {
+            String sessionId = ServletActionContext.getRequest().getSession().getId();
+            synchronized (sessionId.intern()) {
                 session.put(attributeName, locale);
             }
         }
@@ -293,7 +294,8 @@ public class I18nInterceptor extends AbstractInterceptor {
         Map<String, Object> session = invocation.getInvocationContext().getSession();
 
         if (session != null) {
-            synchronized (session) {
+            String sessionId = ServletActionContext.getRequest().getSession().getId();
+            synchronized (sessionId.intern()) {
                 Object sessionLocale = session.get(attributeName);
                 if (sessionLocale != null && sessionLocale instanceof Locale) {
                     Locale locale = (Locale) sessionLocale;
diff --git a/core/src/main/java/org/apache/struts2/interceptor/TokenInterceptor.java b/core/src/main/java/org/apache/struts2/interceptor/TokenInterceptor.java
index 7307c819f..13616712b 100644
--- a/core/src/main/java/org/apache/struts2/interceptor/TokenInterceptor.java
+++ b/core/src/main/java/org/apache/struts2/interceptor/TokenInterceptor.java
@@ -145,7 +145,7 @@ public class TokenInterceptor extends MethodFilterInterceptor {
         //see WW-2902: we need to use the real HttpSession here, as opposed to the map
         //that wraps the session, because a new wrap is created on every request
         HttpSession session = ServletActionContext.getRequest().getSession(true);
-        synchronized (session) {
+        synchronized (session.getId().intern()) {
             if (!TokenHelper.validToken()) {
                 return handleInvalidToken(invocation);
             }