Can I move between http and https-based resources while sharing the same session?

Yes you can. The encryption that occurs when using HTTPS is transparent to the Session object. Any manipulation of the objects contained within a Session object will be independent of the protocol being used.

The container that manages your servlets/JSPs will handle any differences required to process requests/responses between HTTP and HTTPS.