request.getSession().getId() vs request.getRequestedSessionId()

Question

What is the difference between request.getSession().getId() and request.getRequestedSessionId()? Do both of them return the same thing i.e. Session Id?

Thanks

Answer 1

request.getRequestedSessionId() will return the session id specified by the client (presumably in a cookie). request.getSession().getId() will return the server's session id (if a session does not exist, request.getSession() will create it).

The important difference is that you can't rely on the value returned by request.getRequestedSessionId(), since it may not be valid. From the documentation:

Returns the session ID specified by the client. This may not be the same as the ID of the current valid session for this request. If the client did not specify a session ID, this method returns null.