SRV.7.3 Session Scope

HttpSession objects must be scoped at the application/servlet context level. The underlying mechanism, such as the cookie used to establish the session, can be shared between contexts, but the object exposed, and more importantly the attributes in that object, must not be shared between contexts.