Question

I am using the following code to delivery the user to a Welcome page if they are already logged in, or back to the login page if they are not.

        HttpSession session = request.getSession(false);

    if(session == null){
        request.getRequestDispatcher("/WEB-INF/login.jsp").forward(request, response);
    }else{
        //User already logged in. Send to home.
        response.sendRedirect("Welcome");
    }

First time around, it works fine, but if I reload the page even once it sends the user to the welcome page and inevitably sends me back a 500 error because there are elements on that page that cannot be loaded because the user log in code has not been executed.

Does a session get started automatically even if request.getSession(true) is not declared when a page is reloaded? Is there a way to prevent this?

Answer 1

The method request.getSession(false) returns null if there is no current session. I suggest to compare a key too.

Please take a look at this threads.

1. Do JSPs always create a session?
2. How do servlets work? Instantiation, session variables and multithreading