getSession(false) will not create a session, but there are lots of other ways a session can be created without explicity creating one.
For instance, if a JSP is entered that does not explicitly claim not to have a session (for example, <%@ page session="false" %> , one will be created automatically. Try adding this directive to your JSP and you should receive a NullPointerException, as getSession(false) should return null.
A good workman is known by his tools.
posted 10 years ago
you're right, the session is automatically created for the jsp before the first explicit use of the "session" object or a getSession() call if you dont't use the session="false" in the page directive.