public static boolean isSessionCreationEnabled(ServletRequest request) {
        if (request != null) {
            Object val = request.getAttribute(DefaultSubjectContext.SESSION_CREATION_ENABLED);
            if (val != null && val instanceof Boolean) {
                return (Boolean) val;
            }
        }
        //by default
        return true;
    }
Returns {@code true} if a session is allowed to be created for a subject-associated request, {@code false}
otherwise.
<p/>
<b>This method exists for Shiro's internal framework needs and should never be called by Shiro end-users.  It
could be changed/removed at any time.</b>

@param request incoming servlet request.
@return {@code true} if a session is allowed to be created for a subject-associated request, {@code false}
otherwise.
web/src/main/java/org/apache/shiro/web/util/WebUtils.java