I am doing code review on some old code and I found that we are checking if a session exists. Below is an example:
ExternalContext ec = FacesContext.getCurrentInstance().getExternalContext();
HttpSession session = (HttpSession) ec.getSession(false);
if(session!=null)
{...}
else
{ ..}
My question is would an active context, the context of the current request, ever be without a session?
My thought is whether I should allow an error to be thrown if there is no session, or if a request without a session is a normal thing captured appropriately by the if/else statement.