When you call the method with its create argument as true, the servlet reference implementation creates a session if necessary. To properly maintain the session, you must call getSession before any output to response. The following code demonstrates the use of the HttpSession interface to maintain a user's session. To invalidate a session means to remove the HttpSession object and its values from the system. Session tracking relies on cookies.
Some users turn off cookies for various reasons, especially for security reasons.
Session tracking uses session identifiers that are created by the server. In situations where many Web servers and many JVMs are used, the session tracking simply does not work because servers do not always understand each other's session identifiers. How Session Objects Work with Session Identifiers By default, your JSP application participates in the session tracking mechanism. This special number is called a session identifier and is guaranteed as a unique user identifier. On the client side, the browser keeps the session identifier and sends it back to the server on the next request.