Basically, you have two options:
1) Replicate your sessions so that they become available to any Tomcat node. Solutions: Tomcat Cluster , memcached-session-manager , possibly others.
2) Use a load balancer and do sticky sessions. The first requests will be routed randomly on a round-robin basis, but subsequent requests will stick to the same server. Solutions: mod_proxy , hardware traffic dispatchers.
The disadvantage of the first option is that session replication is expensive, not very reliable, and often requires Serializable β only the data that needs to be placed in the session.
The disadvantage of the second approach is that if you disable Tomcat for maintenance, users will be forced to log in again.
You mistakenly believe that "a new session will be created for each request." A new session will be created only if it was not created earlier on the same server or was created, but has already expired.
source share