The page directive's session attribute controls whether session is enabled in a JSP. E.g., the following turns session off:
<%@ page session="false" %>
By default it is "true", i.e., session is enabled.
You don't need to "create" a session. The session object is already available for the JSP, and it can be accessed using the session implicit objects. (See
JSP - Implicit Objects on implicit objects.) See
JSP - Session Tracking for a usage example.
See also
Servlet Session Tracking on using the session object via a servlet.