Best practice is in most cases a session per request. That is, open a session at the beginning of request processing and close it at the end. You can do this in the Filter servlet, for example.
Having one session for the entire application is bad, because it will accumulate many objects in the cache of the 1st level, which is a memory leak. It can also give vague results when several clients use it simultaneously.
However, your code does not use a single session for the entire application - it uses the concept of the "current session", which opens a session and stores it in context (for example, ThreadLocal ). But if you do not close it, he will remain there forever. In addition, this will cause the same problems as described above, because the threads are reused in the web application, and the new request will receive the old unclosed session at some point.
Bozho
source share