If your app needs to support RMI clients then obviously you cannot use the HttpSession and SFSBs might be an acceptable solution.
What is the difference between using a HttpSession & a Stateful Session bean ?
They were both design to do the same, but HttpSession is for web applications a better choice. One reason behind this is that the container can optimize the way the HttpSession data is replicated across the cluster, in a better way than SFSB data. The algorithm is very simple: with HttpSessions the container knows what data got changed, tracing the setAttribute calls. Hence when is about replicating the information to other servers in the cluster the container won�t replicate the whole HttpSession data, but only the changed data. As for SFSB the container has no way to figure out which data was change and the whole session information get replicated any time it changes. Regards.