Encrypted cookies for storing session data
===

I am learning Spring MVC and I'm not able to understand where and how session data is stored.

What I would like to achieve is storing the session data in an encrypted cookie sent to the browser. This is necessary because I plan to run the application on heroku, which does not have sticky sessions. (This is a solution I already use with python, by using pyramid and beaker and I'm pretty happy with it)

I have this toy controller

    public class HelloController implements Controller {
    
        protected final Log logger = LogFactory.getLog(getClass());
    
        public ModelAndView handleRequest(HttpServletRequest request,
                                          HttpServletResponse response)
                throws ServletException, IOException {
    
            logger.info("Returning hello view");
    
            Map<String, Object> myModel = new HashMap<String, Object>();
            myModel.put("key", "value");
    
            return new ModelAndView("hello", "model", myModel);
        }
    }

What happens if I call

            HttpSession session = request.getSession();

in the handleRequest method? I think a session is started in case it does not exist, otherwise the existing one is returned. But where is this session stored? In the browser with a cookie? Or somewhere else?

How can I specify that the session has to be put in a cookie and set the key that has to be used to encrypt it?