Sessions hold a typical
Java collection so there is no limit enforced. Obviously holding huge amounts of data in memory can cause problems that only show up when you get lots of users. Some
servlet engines will serialize sessions out to disk to save memory.
This is a design decision you will have to make based on your own application's characteristics.
Bill