From business perspective, a sequence of requests and responses construct a session. For each client, the servlet engine manages a session for it using cookie or URLRewriting.

In the design of Servlet API, however, Sun chose request and response as central points and attached HttpSession to request object. This is opposed to our normal common sense, but this is also a kind of pattern(Sorry I cannot remember the name of this pattern.)

I have ever read a paper in which the author criticised this design.

Dispatcher just provides us with an API. to make things work, Servlet engine needs to support it INTERNALLY(or INVISIBLY).