HttpSession creation

[Greg Matthews]

hi,   i'm trying to ensure that the only time a session is created is after a successful user login.   is there any other way apart from HttpServletRequest.getSession( ), or HttpServletRequest.getSession( boolean create) that a HttpSession can be created?   i've trawled through the J2EE API but haven't seen any other methods that might create a session -- was just wondering if there was some sort of side-effect way, say, if you redirect a request or pass a request through a filter chain or something???   thanks, greg.