I'm going to assume you are referring to the HttpSession object and not a J2EE Session bean object.
If you have just one server, then the Session is just like a sort of global Map that can be accessed whenever your user makes a request. Large objects or small objects, either way, they can be put in the map, but depending on how long you leave them there they can be problematic.
Most application servers remove sessions that have expired, so if you expect visitors to leave the site after a while, then perhaps you don't need to do any session maintenance and you can just let the sessions expire, and the application server will clean up after you.
However, if you expect that a lot of users will remain on the site for a long time, and could potentially have these long-lasting objects in their sessions, and you might not have enough memory to handle this, then you need some other approach.
The simplest approach might be to use some kind of LRU cache. You could, for example, use the commons LRUMap which lets you set a maximum size on the map and removes items that it no longer needs. This way, you can have a global cache for your large objects, and if you have too many users then the cache simply drops data. Performance suffers if there are a lot of cache misses, but at least everything still functions properly.
At the end of the day, if you don't have enough ram to cache stuff and enough database bandwidth to handle the misses, your app is going to crash no matter what tricks you use.
The drawbacks to using the HttpSession:
- If you have multiple servers, it complicates fail-over or load balancing.
- Sessions, if long-lived, can be a sort of memory leak, where data is cached there and never read or cleaned up.
- Sessions are not shared per-user, so they are not useful as general-purpose caches.
Drawbacks to a global Map as a cache:
- You have to clean up the data yourself, or use a third-party library which does the cleanup.
- If you have multiple servers, users need to stay on the same server in order to benefit from the cache.
- However unlike Sessions, if there is data that can be shared per-user, it's easy with a global map.