Is a session object always created on a JSP page, and can its creation be disabled?

No, not always. By default, the session object is available on all JSP pages. This is because the directive <%@ page session="true" %> is enabled by default. To disable automatic creation of the session object for a specific page, you need to set the session attribute to false:

<%@ page session="false" %>

The directive <%@ page import="javax.servlet.http.HttpSession" %> remains active, but attempting to get the session via request.getSession() without creating one (e.g., request.getSession(false)) will return null if the session has not been created earlier in this request or during previous user interactions with the application.

Disabling the session can be useful for static pages or pages that do not require state preservation between requests, which can slightly reduce the server load.