How do you manage sessions if the web servers are load balanced onto more than one server?

Nicola Ken Barozzi

Session management is automatic if the server supports load-balancing on more machines.
The JavaWorld article What's New in Java Servlet API 2.2? clarifies on the subject in the paragraph Distributed Applications.

The following is taken from that doc.

Distributed Applications

A few clarifications were also made in 2.2 with regards to distributed applications, in which application components can be spread across multiple back-end server machines.

The specification dictates that, for an application marked as distributable in its deployment descriptor, there will be a single ServletContext instance per JVM. This means the context attributes cannot be used to share global information. Global information in a distributed app needs to be stored externally from the Web server, as is the case in database or EJB component.

An application marked as distributable also has special rules for user sessions. Servers will use session affinity to efficiently manage user state across multiple back-end servers. This means that all requests that are part of a single session from a particular user are to be handled by only one JVM at a time. This in turn eliminates the need to constantly replicate session information across all the back-end servers. Responsibility for the session can be moved to another server between user requests, though in practical terms this is unlikely to occur frequently. Still, to enable the moving of a session, all objects placed into a session by servlets in a distributed application must implement Serializable. A Web server can throw an IllegalArgumentException if this condition is not met. Nondistributed apps, of course, can store any objects into the session.