title: request.getSession(false) is not returning null
body: <p>I am trying to create a sample application. I am unable to understand why the following is happening.</p>
  
  <p>My AuthFilter:</p>
  
  <pre><code>public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException {
          System.out.println("Reached AuthFilter");
          HttpServletRequest request = (HttpServletRequest) req;
          HttpServletResponse response = (HttpServletResponse) resp;
          HttpSession session = request.getSession(false);
          System.out.println("request.getSession(false)" + request.getSession(false));
  
          if (session == null) {
              System.out.println("Going to index.jsp");
              response.sendRedirect(request.getContextPath() + "/index.jsp");
          } else {
              System.out.println("Going to the servlet ");
              chain.doFilter(req, resp);
          }
      }
  </code></pre>
  
  <p>In my Servlet after checking the userName and password, I want to direct the user based on the provided details. </p>
  
  <p>My Servlet Code:</p>
  
  <pre><code>    if (validUser) {
          System.out.println("Valid user. So, Going to another servlet /welcome.do");
          request.getRequestDispatcher("/welcome.do").forward(request, response);
      } else if (request.getSession(false) != null) {
          System.out.println("Already there is a session is associated with the user");
          request.getRequestDispatcher("secure/welcome.jsp").forward(request, response);
      } else {
          System.out.println("I am in else");
          request.getRequestDispatcher("/login-error.jsp").forward(request, response);
      }
  
  The Output:
  
  23:28:06,153 INFO  [stdout] (http--127.0.0.1-8080-1) Reached AuthFilter
  23:28:06,153 INFO  [stdout] (http--127.0.0.1-8080-1) request.getSession(false)org.apache.catalina.session.StandardSessionFacade@3c6d1e82
  23:28:06,154 INFO  [stdout] (http--127.0.0.1-8080-1) Going to the servlet 
  23:28:06,437 INFO  [stdout] (http--127.0.0.1-8080-1) userName = xxx
  23:28:06,439 INFO  [stdout] (http--127.0.0.1-8080-1) Retrieved passCode = xxx
  23:28:06,440 INFO  [stdout] (http--127.0.0.1-8080-1) password.equals(passCode) = false
  23:28:06,441 INFO  [stdout] (http--127.0.0.1-8080-1) Already there is a session is associated with the user
  </code></pre>
  
  <p>I want my users to be sent to welcome page, if there is a session associated with them, else I want them to be sent to error page. But this code is sending the user with incorrect password to welcome page. Can anyone explain why?</p>