request.getSession(true)的含义

我们看一下API说明
public HttpSession getSession(boolean create)

Returns the current HttpSession associated with this request or, if if there is no current session and create is true, returns a new session.

If create is false and the request has no valid HttpSession, this method returns null.

To make sure the session is properly maintained, you must call this method before the response is committed. If the container is using cookies to maintain session integrity and is asked to create a new session when the response is committed, an IllegalStateException is thrown.

Parameters:
true - to create a new session for this request if necessary; false to return null if there's no current session
Returns:
the HttpSession associated with this request or null if create is false and the request has no valid session
See Also:
getSession()

可见，此方法返回与request关联的HttpSession对象，如果不存在，则创建一个新的并返回。
你必须在response提交前调用这个方法。如果容器使用cookies来维持session的交互，在response已经提交的时候创建一个新的Session,将引起IllegalStateException 异常