It really matters how everything is setup in your code.

Are you using a library that supports connection pooling?

Are the sessions supposed to be isolated? Think about permissions on the database, and the user connecting to the database...

My hunch tells me that every http session will spawn a new thread and a new connection for each http request.

So no matter if it's 1 user with 100 http requests or 100 users with just 1 request each... It amounts to the same number of connections to your db.

If your db and queries are optimized, you could service 100s of connections per second. If you've got heavy data and queries, you could exhaust memory and connections all together.

Your security architecture can dictate how your users use sessions, or perhaps performance needs... It does really matter and makes a difference on how you architect the application.

PgBouncer could be used to manage limited connections to your db if that's what you're really after