as stated above, from the API it says
Returns the current HttpSession associated with this request or, if there is no current session and create is true, returns a new session.
If create is false and the request has no valid HttpSession, this method returns null
Therefore, if you call getSession(false) and the session currently exists within the SessionManager and has not timedout, it will return the session. If it does not exist, or has timedout it will return null.
getSession(true) will return a session regardless. Therefore if the session has expired it will return a NEW session.
thanks
codemwnci.