Let's say I have a website with a rather large number of visits, perhaps 10-20 per second with occasional brief spikes of 10 times that or so. Strictly from a performance perspective, is there a measurable downside to keeping Hibernate sessions open for the entire length of the request? The documentation seems to indicate that opening a Hibernate session at the repository level is an anti-pattern, especially if you're going to be making more than one repository call, but perhaps I could carefully fine-tune my session openings at the level of some aggregate service. Is there a general best practice that I should default to?

I'd actually say that each request is often a single transaction. I mean, a client wants data, and you need to send them the data they want, or they want to update data, and they want to know it was all updated properly. Each is a request, and each should be a single transaction. So, most of the time, it's a single transaction per request, which also implies a single session per request.