I understand the difference between request.getSession(true) and request.getSession(false). But request.getSession() & request.getSession(true) look very similar!
Both "return the current session associated with this request", but differ in:
request.getSession():"or if the request does not have a session, creates one"
request.getSession(true):"if there is no current session, returns a new session"
I don't understand the difference between them, is it that (if none exists) they create a new session but the first one doesn't return it but the second one does?
Source: http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html
Edit:
Someone tagged/marked my question as duplicate even though it isn't. I will explain why.
I have explicitly asked for the difference between request.getSession() & request.getSession(true) and NOT between request.getSession(true) & request.getSession(false)! I have stated , again explicitly, that I already understand the difference b/w ..(true) & ..(false).
The question linked as a possible duplicated of of asks about the difference b/w ..(true) & ..(false) and not ..(true) & ..()
request.getSession() will return a current session. if current session does not exist, then it will create a new one.
request.getSession(true) will return current session. If current session does not exist, then it will create a new session.
So basically there is not difference between both method.
request.getSession(false) will return current session if current session exists. If not, it will not create a new session.
request.getSession() or request.getSession(true) both will return a current session only . if current session will not exist then it will create a new session.
A major practical difference is its use:
in security scenario where we always needed a new session, we should use request.getSession(true).
request.getSession(false): will return null if no session found.
request.getSession(true) and request.getSession() both do the same thing, but if we use
request.getSession(false) it will return null if session object not created yet.
Method with boolean argument :
request.getSession(true);
returns new session, if the session is not associated with the request
request.getSession(false);
returns null, if the session is not associated with the request.
Method without boolean argument :
request.getSession();
returns new session, if the session is not associated with the request and returns the existing session, if the session is associated with the request.It won't return null.
They both return the same thing, as noted in the documentation you linked; an HttpSession object.
You can also look at a concrete implementation (e.g. Tomcat) and see what it's actually doing: Request.java class. In this case, basically they both call:
Session session = doGetSession(true);
Source: Stackoverflow.com