GlassFish v2 destroys a web application's session manager and all its sessions when the web application is redeployed. A redeploy is nothing other than an undeploy (which removes any traces of the web application from the domain/cluster), followed by a deploy.
There is work planned for GlassFish v3 to support versioning of applications, where it will be possible to upgrade from one version of a web application to another, without having to stop and restart an instance (during a rolling upgrade in a cluster), and without the need for redeployment: The administrator will be able to "switch" from the active version of an application to another deployed version of the same application. This will also allow any of the application's active sessions to be preserved and migrated to the new version of the application. As you've pointed out, the migrated sessions will have to be externalized (serialized) and then loaded by the classloader associated with the new version of the application.
[Message sent by forum member 'jluehe' (jluehe)]
http://forums.java.net/jive/thread.jspa?messageID=264862