Well, not the session (for reasons already mentioned above
). You are going to need some sort of application scoped implementation that can recognize there is a request from userA and they are chatting to userB. That is the fairly easy part, the harder part is how you "push" a chat response to userB, given HTTP does not support pushing data to clients.
You can address this in various ways. One would be to write the client as an
Applet that registers itself with some sort of server component. Or you could take the (very naive) approach of having clients poll the server for messages (this is naive, because its hard to see the different between this sort of behaviour and a DDOS attack!). Or you could look at something like Comet which could give you simulated push behaviour.