According to the API documentation of the HttpServletRequest.getRequestedSessionId() method:
Returns the session ID specified by the client. This may not be the same as the ID of the current valid session for this request. If the client
did not specify a session ID, this method returns null.
The session ID it returns is either transmitted through a cookie or a URL parameter. This allows an end user to manually update the value of this
session ID in an HTTP request.
Due to the ability of the end-user to manually change the value, the session ID in the request should only be used by a servlet container (e.g.
Tomcat or Jetty) to see if the value matches the ID of an existing session. If it does not, the user should be considered unauthenticated.
What is the potential impact?
Using a client-supplied session ID to manage sessions on the server side can potentially have an impact on the security of the application.
Impersonation (through session fixation)
If an attacker succeeds in fixing a user’s session to a session identifier that they know, then they can impersonate this victim and gain access to
their account without providing valid credentials. This can result in unauthorized actions, such as modifying personal information, making
unauthorized transactions, or even performing malicious activities on behalf of the victim. An attacker can also manipulate the victim into performing
actions they wouldn’t normally do, such as revealing sensitive information or conducting financial transactions on the attacker’s behalf.
