From an HTTP session management perspective, every WAR deployed to GlassFish is treated as an independent unit, regardless of whether the WAR has been deployed standalone or as part of an EAR. In other words, the HTTP session managers of the WARs deployed to GlassFish are all isolated from each other.
This means that it is not possible for a standalone or EAR-embedded WAR to access the HTTP sessions of another WAR.
The only kind of sessions that may be shared across WAR files in GlassFish are those related to Single-Sign-On (SSO).
[Message sent by forum member 'jluehe' (jluehe)]
http://forums.java.net/jive/thread.jspa?messageID=270845