Session Management in Liferay

Session Management  in Liferay 

The private-session-attributes settings in liferay-portlet.xml determines what session your JSR168 deployed portals will use. This setting affects the sharing of APPLICATION_SCOPE session attributes between the portal, portlets (in the same WAR, and across different WARs) and the servlets in these WARs.
Sharing of session attributes from the portal to private portlets is also determined by the session.shared.attributes setting, which you can override in your portal-ext.properties file. Session attributes with the configured prefix on the portal session will be visible from any private portlets too.

Summary 

• Non-private portlets read and write to the Portal session.
• Private portlets write to their own WAR session.
• Private portlets can read shared attributes of the Portal session. They try to read from their own WAR session first, then looks up any shared attributes copied from the Portal session.
• Normal servlets only have access to the WAR session, and cannot directly access the Portal session. In order to read shared session attributes, servlets need a private portlet in the same WAR file to copy it for them. Or you can configure your servlet to use the portal session by using Liferay's PortalDelegateServlet mechanism.

Links 

For an in depth explaination including diagrams, see my blog posts here:
http://longgoldenears.blogspot.com/2008/03/liferay-session-sharing-demystified.html
http://longgoldenears.blogspot.com/2008/03/portaldelegateservlet-servlet-session.html