HTTP is stateless. Meaning that the data returned by the server does not depend on any previous actions by the user.
Cookies and other non-HTTP methods is what makes the web appear to be stateful, enabling user to for example log-in and out on websites.
Check out:
http://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html
For an application developers, it IS stateless always.
For end users it is appears to be statefull
Now,
Each HTTP request results in a new invocation of a servlet (i.e., a thread calling the servlet’s service and doXxx methods), regardless of whether the connection is keep-alive or not.
EDIT:
HttpSession object is used to set information related to a specific session say, the number of products in a cart for the current session. Note that session gets closed if the browser is closed or if you clear the cookies.
How does the webserver know that its the same session?
Webservers sends a sessionId to the browser in the form of cookie. And, the browser sends the cookie having sessionId back to the server for subsequent requests.
How does the browser identifies which cookies to send for a link/request?
It is based on the these parameters. If the request matches these parameters the browser sends that particular cookie:
Domain: The domain name to which the request is made.
Path: If the context root path name is same.
Secure: Server sends if the given cookie if it can be sent on this non-secure channel
If cookies are disabled then it uses URL-rewriting.
Is it possible to retain the session even after the browser is closed and opened?
Yes. The answer is cookie + DB + Googling :)