request.getSession(true) will return the current session if one exists, if one doesn't exits a new one will be created.
So there is actually no difference between the two methods.
?
HOWEVER, if you use request.getSession(false), it will return the current session if one exists and if one DOES NOT exist a new one will NOT be cretaed.