getSession(false) will not create a session, but there are lots of other ways a session can be created without explicity creating one.
For instance, if a JSP is entered that does not explicitly claim not to have a session (for example, <%@ page session="false" %> , one will be created automatically. Try adding this directive to your JSP and you should receive a NullPointerException, as getSession(false) should return null.
A good workman is known by his tools.
Joined: Mar 25, 2006
you're right, the session is automatically created for the jsp before the first explicit use of the "session" object or a getSession() call if you dont't use the session="false" in the page directive.