Follow these guidelines when using HTTP sessions:
Create sessions sparingly. Session creation is not free. If a session is not required, do not create one.
Use javax.servlet.http.HttpSession.invalidate() to release sessions when they are no longer needed.
Keep session size small, to reduce response times. If possible, keep session size below seven KB.
Use the directive <%page session="false"%> in JSP files to prevent the Server from automatically creating sessions when they are not necessary.
Avoid large object graphs in an HttpSession. They force serialization and add computational overhead. Generally, do not store large objects as HttpSession variables.
Do not cache transaction data in HttpSession. Access to data in an HttpSession is not transactional. Do not use it as a cache of transactional data, which is better kept in the database.