request.getSession() will return the current session and if one does not exist, a new session will be cretaed.

request.getSession(true) will return the current session if one exists, if one doesn't exits a new one will be created.

So there is actually no difference between the two methods HOWEVER, if you use request.getSession(false), it will return the current session if one exists and if one DOES NOT exist a new one will NOT be cretaed.