Originally posted by ak pillai: Yes as ulf said by deafault no session is created but you can create a session by
<%@ page session="true">
You've got it backwards. By default, JSPs create a session for you. If you don't want your JSP to create a session, you have to use <%@ page session="false">
If the application server creates an HttpSession for a user, that HttpSession is the same session used by every JSP and Servlet that user accesses. If you stuff some great data in the HttpSession in a Servlet, the client will be able to yank that data out of the HttpSession in any JSP or other Servlet in the application. Well, until their session times out, that is.