Where is the HttpSession data stored?

Question

HttpSession is a high level interface built on top of cookies and url-rewriting, which means that there is only a session ID is stored in client side and the da

Answer 1

It's up to the server where to store session data; the ones I'm familiar with allow some level of configuration as to where (disk, DB, memory, ...) session data is stored.

Different clients shouldn't be working on the same session data--session data is per-client. That said, a single client (like a web browser) could have multiple windows or tabs open, and yes, that can cause issues.

Clustering adds a layer of complexity/headache as session data is shared between servers.