What's the best practice?
I've googled around, and there's no consensus. Everyone says something, and then takes it back. I find lugging a session around stupid...
So, what's the deal?
It really depends on the app, but really you only want a session to last as long as the logical transaction on the database. I'm pretty sure sessions aren't thread-safe so you may want to look at localising the behaviour to a single class.
What you really want to avoid is the session-per-operation scenario, where for every single database operation a new Hibernate session is created and closed.
EDIT: Ignore my earlier nonsense about one session for the lifetime of the app, it's entirely possible (and probably the most efficient way) of doing this. Just make sure to demarcate your transactions appropriately - be it declaratively using something like Spring @Transaction, or programmatically.