use request.getSession() from controller / servlet. And request in this case is HTTPServletRequest.Well jsp is the one that would be converted to a servlet and then the converted servelt would produce the required HTML output for the browser.And session tracking is done using cookies and transfering a sessionID in it.If a session is created then you will always get session from request.getSession(false) always for all subsequent request and null in case session is not created.