Why Isn't Session Null

Question

I am using the following code to delivery the user to a Welcome page if they are already logged in, or back to the login page if they are not.

        HttpSession session = request.getSession(false);

    if(session == null){
        request.getRequestDispatcher("/WEB-INF/login.jsp").forward(request, response);
    }else{
        //User already logged in. Send to home.
        response.sendRedirect("Welcome");
    }

First time around, it works fine, but if I reload the page even once it sends the user to the welcome page and inevitably sends me back a 500 error because there are elements on that page that cannot be loaded because the user log in code has not been executed.

Does a session get started automatically even if request.getSession(true) is not declared when a page is reloaded? Is there a way to prevent this?

Answer 1

Probably the session is being created upon forwarding to login.jsp. That's necessary because the user has to be assigned to an unauthenticated request and then authenticate it. If you want to redirect based on whether the user is logged in or not, use SessionContext's getCallerPrincipal.

For more info, check this (somewhat old, but still relevant) article