Sessions are stored in a collection such as a hashtable with the sessionID as key. Some
servlet engines provide for serializing sessions to disk - eventually you will run into a limit of what memory/or disk can hold, but that number has got to be pretty high.
Bill