How does session management work internally within the servlet en gine?

This very much depends on the servlet engine. Sometimes sessions are stored only in memory, in a HashSet of session IDs and the HttpSession. Some servlet engines support serializing session information to a file system or database, which allows the servlet engine to restart without losing session information, and to allow a cluster of web servers to use the same pool of sessions. Each servlet engine should provide details of the features of their session management. If you want to look at actual implementations, there are numerous open source projects including Tomcat (http://jakarta.apache.org/), and others.