public final class HttpSession

State kept for one client across requests, found again through a cookie.

@PostMapping("/login")
  public void login(HttpServer.Request request, @RequestBody Map body) {
      ...
      HttpSession session = request.getSession(true);
      session.changeSessionId();          // never keep a pre-login id
      session.setAttribute("user", userId);
  }

A session is created only when something asks for one with getSession(true), so a server that never does sets no cookie and keeps nothing. The cookie is HttpOnly, SameSite=Lax and, on a TLS server, Secure; its name, lifetime and store are configured under cn1.session.*.

Attributes live in the SessionStore. The in-memory store keeps any object; the database store keeps what Json can write – strings, numbers, booleans, and maps and lists of those – because it has to read them back in another process.

A session-scoped bean is never written to a store: the server that built it keeps it in memory for as long as the session lives, and runs its destroy methods when the session is invalidated, expires or the server stops. Another instance behind a load balancer builds its own.