Stateful EJBs in web application

in which case to use them on a web application?

The traditional example of SFSB and web app is the shopping cart. But at the same time, you can do the same with the HttpSession.

Ideally, if the state relates to the business logicand not the presentation logic, it should go in a SFSB. But inpractice, people usually advocates against SFSB (because of thecomplexity it introduces) unless they provide something you can not doeasily with the HttpSession. Most of the time, you can tweak the design to store the information in the HttpSession or the database and pass it around, without the need to have SFSB. But it's ultimately a question of design purity.

And how? Should we put these stateful beans in Session (because of stateless http)?

The EJB model is a richer model than the HttpSession,because EJB are transactional components, and there are explicitcallbacks for the passivation and activation of SFSB. This comes withan increased complexity about how to use SFSBcorrectly, notably (1) exception handling and (2) concurrency and (2)removal and time-out of SFSB. See my answers here for more details:

• Java: Tracking a user login session - Session EJBs vs HTTPSession
• Correct usage of Stateful Beans with Servlets

If you want to use them, you will need first to look up the SFSB toget a reference to one fresh remote instance. Then you will need tostore this reference somewhere in a way to reuse it across requests.This somewhere is usually the HttpSession, which means that even if you use SFSB, you can't get rid of it completely.

With EJB2, the remote reference -- called a handle -- couldbe serialized to be reused later. It was then possible to store if forinstance in database, even though I've never seen that. I don't know ifit's still possible with EJB3.

Is it a good practice?

As I said already, people usually advice against it unless you know exactly why you would use them rather than the HttpSessionand only if you have a good command of the EJB model. (SFSB could bejustified for instance if the business service is accessible through aweb front-end and a desktop client) Lots of other frameworks don't have something similar as SFSB and people still manage to create great apps with them.