when we say request.getSession () a sesion is returned with a session id associated with it. then you send the response back and if user has cookies enabled then calling isNew () will always return false because the session was created when you said request.getSession () in your servlet code.