request.getSession(false)

/**
* Returns the current HttpSession
* associated with this request or, if there is no
* current session and create is true, returns
* a new session.
*
*

If create is false
* and the request has no valid HttpSession,
* this method returns null.
*
*

To make sure the session is properly maintained,
* you must call this method before
* the response is committed. If the container is using cookies
* to maintain session integrity and is asked to create a new session
* when the response is committed, an IllegalStateException is thrown.
*
* @param create true to create
* a new session for this request if necessary;
* false to return null
* if there’s no current session
*
* @return the HttpSession associated
* with this request or null if
* create is false
* and the request has no valid session
*
* @see #getSession()
*/
public HttpSession getSession(boolean create);
源码
大概意思：
getSession(boolean create)意思是返回当前reqeust中的HttpSession ，如果当前reqeust中的HttpSession 为null，当create为true，就创建一个新的Session，否则返回null；

简而言之：

HttpServletRequest.getSession(ture) 等同于 HttpServletRequest.getSession()

HttpServletRequest.getSession(false) 等同于 如果当前Session没有就为null；

   HttpSession session = req.getSession(false);

 HttpSession session = request.getSession();   // a new session created if no session exists， 哈哈！完蛋啦！如果session不存在的话你又创建了一个！  
String user_name = session.getAttribute("user_name"); 

需要注意的地方是request.getSession() 等同于 request.getSession(true)，除非我们确认session一定存在或者sesson不存在时明确有创建session的需要，否则尽量使用request.getSession(false)。在使用request.getSession()函数，通常在action中检查是否有某个变量/标记存放在session中。这个场景中可能出现没有session存在的情况，正常的判断应该是这样：

    HttpSession session = request.getSession(false);  
    if (session != null) {  
        String user_name = session.getAttribute("user_name");  
    }  

【投机取巧】：

如果项目中用到了Spring（其实只要是Java的稍大的项目，Spring是一个很好的选择），对session的操作就方便多了。如果需要在Session中取值，可以用WebUtils工具（org.springframework.web.util.WebUtils）的getSessionAttribute(HttpServletRequest request, String name)方法，看看高手写的源码吧：哈哈。。

[java] view plain copy

    /** 
     * Check the given request for a session attribute of the given name. 
     * Returns null if there is no session or if the session has no such attribute. 
     * Does not create a new session if none has existed before! 
     * @param request current HTTP request 
     * @param name the name of the session attribute 
     * @return the value of the session attribute, or <code>null</code> if not found 
     */  
    public static Object getSessionAttribute(HttpServletRequest request, String name) {  
        Assert.notNull(request, "Request must not be null");  
        HttpSession session = request.getSession(false);  
        return (session != null ? session.getAttribute(name) : null);  
    }  

注：Assert是Spring工具包中的一个工具，用来判断一些验证操作，本例中用来判断reqeust是否为空，若为空就抛异常。

上面的代码又可以简洁一下啦，看吧：

[java] view plain copy

    HttpSession session = request.getSession(false);  
    String user_name = WebUtils.getSessionAttribute(reqeust, "user_name");