protected void recordWebflowSessionPinningInfo(final FlowExecution execution) {
        val clientInfo = Objects.requireNonNull(ClientInfoHolder.getClientInfo(), "Client info cannot be null");
        Assert.hasText(clientInfo.getUserAgent(), "User-agent cannot be null or empty");
        Assert.hasText(clientInfo.getClientIpAddress(), "Client IP address cannot be null or empty");
        execution.getConversationScope().put(WEBFLOW_USER_AGENT, clientInfo.getUserAgent());
        execution.getConversationScope().put(WEBFLOW_CLIENT_IP_ADDRESS, clientInfo.getClientIpAddress());
    }
Client flow storage has not backing store independent from the flow key, so no locking is required.
core/cas-server-core-webflow-api/src/main/java/org/apereo/cas/web/flow/executor/ClientFlowExecutionRepository.java