Why is Code 1 working but not Code 2 when accessing session attributes?

I'm facing an issue where my session attribute works fine in Code 1, but not in Code 2.

Code 1 (Working)

session.setAttribute("userId", foundUser.getId());

Object sessionUserId = session.getAttribute("userId");

System.out.println("Session ID: " + session.getId());

response.put("message", "Login Successful");
return ResponseEntity.ok(response);

Code 2 (Not working)

session.setAttribute("userId", foundUser.getId());

System.out.println("Session ID: " + session.getId());

response.put("message", "Login Successful");
return ResponseEntity.ok(response);

Issue

In Code 1, after setting the session attribute, I retrieve it using session.getAttribute("userId"), and everything works fine.
In Code 2, I don’t retrieve the session attribute, and the session-related functionality does not work as expected.

My question is Question, Please answer and explain that Object thing as simply as possible ... Thank You

Why does accessing the session attribute explicitly (as in Code 1) make a difference? Shouldn't setting it (session.setAttribute(...)) be enough for it to persist?

I tried these two methods, I want to store session data without JWT and I'm not using Spring Security. For learning making this for the first time. Although It's working after 1-2 days of searching but.. I want to know why ??

Why is Code 1 working but not Code 2 when accessing session attributes?

I'm facing an issue where my session attribute works fine in Code 1, but not in Code 2.

Code 1 (Working)

session.setAttribute("userId", foundUser.getId());

Object sessionUserId = session.getAttribute("userId");

System.out.println("Session ID: " + session.getId());

response.put("message", "Login Successful");
return ResponseEntity.ok(response);

Code 2 (Not working)

session.setAttribute("userId", foundUser.getId());

System.out.println("Session ID: " + session.getId());

response.put("message", "Login Successful");
return ResponseEntity.ok(response);

Issue

In Code 1, after setting the session attribute, I retrieve it using session.getAttribute("userId"), and everything works fine.
In Code 2, I don’t retrieve the session attribute, and the session-related functionality does not work as expected.

My question is Question, Please answer and explain that Object thing as simply as possible ... Thank You

Why does accessing the session attribute explicitly (as in Code 1) make a difference? Shouldn't setting it (session.setAttribute(...)) be enough for it to persist?

I tried these two methods, I want to store session data without JWT and I'm not using Spring Security. For learning making this for the first time. Although It's working after 1-2 days of searching but.. I want to know why ??

• java
• spring-boot
• authentication
• security
• httpsession

1 Answer 1

Code 1: "I need this now" → Java commits it immediately

Code 2: "Store this when convenient" → Java might delay it for performance

Java tries to be efficient by delaying the actual write operation.

It's a tradeoff between performance optimization and immediate persistence → Java chooses performance by default, which is why you sometimes need to explicitly force the persistence.