1. HTTPSession Object & URL Rewriting

As HTTP protocol is stateless, Java uses HTTPSession object as a session holder. This objects contains a map of property/value that you can get to see attributes hold in session. This is a example of HTTPSession being used:

As we can see, first we get the session from request object, and then we use getAttribute(String attr) method. There’re some Listeners that we can use to see changes in HTTPSession.
 - javax.servlet.http.HttpSessionBindingListener interface: see when some data is added or removed from HTTPSession.
 - javax.servlet.http.HttpSessionActivationListener interface: see when the session is activate or passivate. (passivate means moved from VMs or restored from persistence.)
- Also, they have the max inactive period, which can be recovered using get/setMaxInactivePeriod()
- You can use invalidate() method to invalidate the HTTPSession.

You can map a user to a specific session saving their ID into a cookie. If the user don’t have cookies activated, you can do some URL rewriting and use his ID in URL, something like: http://www.myjeeapp.com/cart?jsessionid=123baacd1.
This is not a good practice because the security of this is not ok. You’re showing the user state on a URL to anyone. By default, the session control is made using cookies. 
If you wanna check if that session is coming from cookies, you can ask with method isRequestedSessionFromCookie()

For example, as WAP (Wireless Application Protocol) doesn't support cookies, and you probably want to add session tracking, you should use <url-session-tracking/> tag on you web descriptor.

1. Web Tier

Are concerns of Web Tier:

2. Servlet Lifecycle

3. JSP Lifecycle

4. JSF Lifecycle

5. MVC