Use this if you want to be web agnostic (independent of the servlet API)

ActionContext.getContext().getSession()

The following gives you the same thing as above:

ServletActionContext.getRequest().getSession()

Note: Be sure not to use ActionContext.getContext() in the constructor of your action since the values may not be set up already (returning null for getSession()).

If you really need to get access to the HttpSession, use the ServletConfigInterceptor (see Interceptors).