Difference between request.getSession() and request.getSession(true)

39
votes

I understand the difference between request.getSession(true) and request.getSession(false). But request.getSession() & request.getSession(true) look very similar!

Both "return the current session associated with this request", but differ in:

request.getSession():

"or if the request does not have a session, creates one"

request.getSession(true):

"if there is no current session, returns a new session"

I don't understand the difference between them, is it that (if none exists) they create a new session but the first one doesn't return it but the second one does?

Source: http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html

Edit:

Someone tagged/marked my question as duplicate even though it isn't. I will explain why.

I have explicitly asked for the difference between request.getSession() & request.getSession(true) and NOT between request.getSession(true) & request.getSession(false)! I have stated , again explicitly, that I already understand the difference b/w ..(true) & ..(false).

The question linked as a possible duplicated of of asks about the difference b/w ..(true) & ..(false) and not ..(true) & ..()

7
javajsphttpsessionservlets
All 3 answers are correct, similar and useful, however @Jan was the first to answer. - Ali Khan
possible duplicate of Difference between request.getSession().getId() and request.getSession(false)? - Krutik Jayswal
@KrutikJayswal Did you even READ my question before flagging it? I EXPLICITLY stated that I am NOT asking about difference between ..Session(true) & ..Session(false)! or (implicitly) b/w ..Session() & ..Session(false)! I asked about difference between ..Session() & ..Session(true)! for which I received perfectly reasonable answers! Upon which I marked my question "[SOLVED]"!!! - Ali Khan
@Sotiros Why did you edit my question? - Ali Khan

7 Answers

79
votes

request.getSession() will return a current session. if current session does not exist, then it will create a new one.

request.getSession(true) will return current session. If current session does not exist, then it will create a new session.

So basically there is not difference between both method.

request.getSession(false) will return current session if current session exists. If not, it will not create a new session.

39
votes

request.getSession() is just a convenience method. It does exactly the same as request.getSession(true).

6
votes

Method with boolean argument :

  request.getSession(true);

returns new session, if the session is not associated with the request

  request.getSession(false);

returns null, if the session is not associated with the request.

Method without boolean argument :

  request.getSession();

returns new session, if the session is not associated with the request and returns the existing session, if the session is associated with the request.It won't return null.

4
votes

They both return the same thing, as noted in the documentation you linked; an HttpSession object.

You can also look at a concrete implementation (e.g. Tomcat) and see what it's actually doing: Request.java class. In this case, basically they both call: 

Session session = doGetSession(true);
3
votes

A major practical difference is its use:

in security scenario where we always needed a new session, we should use request.getSession(true).

request.getSession(false): will return null if no session found.
1
votes

request.getSession(true) and request.getSession() both do the same thing, but if we use request.getSession(false) it will return null if session object not created yet.

0
votes

request.getSession() or request.getSession(true) both will return a current session only . if current session will not exist then it will create a new session.