Make sure Java's Session and Flash always exists even if empty req attrs

mkurz · mergify[bot] · commit aa3e91969af9 · 2025-07-15T12:47:27.000Z
diff --git a/core/play/src/main/java/play/mvc/Http.java b/core/play/src/main/java/play/mvc/Http.java
@@ -373,7 +373,10 @@ default Long id() {
      * {@link Cell} to store the session cookie, to allow it to be evaluated on-demand.
      */
     default Session session() {
-      return attrs().get(RequestAttrKey.Session().asJava()).value().asJava();
+      return attrs()
+          .getOptional(RequestAttrKey.Session().asJava())
+          .map(cell -> cell.value().asJava())
+          .orElseGet(() -> new Session());
     }
 
     /**
@@ -382,7 +385,10 @@ default Session session() {
      * store the flash, to allow it to be evaluated on-demand.
      */
     default Flash flash() {
-      return attrs().get(RequestAttrKey.Flash().asJava()).value().asJava();
+      return attrs()
+          .getOptional(RequestAttrKey.Flash().asJava())
+          .map(cell -> cell.value().asJava())
+          .orElseGet(() -> new Flash());
     }
 
     /**
