The session scope lives across multiple HTTP request-response cycles (theoretical unlimited).
The request scope is very useful in any web application when you need a single interaction per HTTP request-response cycle. However, when you need objects visible for any HTTP request-response cycle that belongs to a user session, then you need a session scope; in this case, the bean lives as long as the HTTP session lives. The session scope allows you to create and bind objects to a session. It gets created upon the first HTTP request involving this bean in the session and gets destroyed when the HTTP session is invalidated.
Note
The session scope is present in JSF and CDI and it functions the same way in both. Commonly, it is used for AJAX and non-AJAX requests that process user-specific data (such as credentials, shopping carts, and so on).
Therefore, the first HTTP request initializes the session and stores the objects, while the subsequent requests have access to these objects...