I'd like to know when to expect a "null" when calling HttpServletRequest.getSession(false)
Also: Are there good tutorials on HttpSession? I'd like to get details like: when to invalidate()? what are the consequences? do I need to check if the returned HttpSession is valid? ... <== Answer that in a comment please.
You should practically never expect a null value. As the documentation says, if there is no active session for a request (usually, you would check for that in the filter chain of a request), a session will be created. If you get a null value from this, I'd wager that there is a problem in the underlying OS: Not enough memory to spawn a session would come to mind.
