everything but nothing.
Its all on the type of client thats accessing the app and what container is managing it.
If the client is accessing an EJB the EJB (J2EE or J5EE) container is managing a session state of the client and handles EJB transactions and such
If the client is accessing a web page or any content based on a servlet/jsp then the servlet container is managing the state of the client for calls to different web sites(ie logged in versus not )
you may want to check out this.
http://www.jguru.com/faq/view.jsp?EID=1082544