# V5316. Do not use the 'HttpServletRequest.getRequestedSessionId' method because it uses a session ID provided by a client.

The analyzer has detected the use of `HttpServletRequest.getRequestedSessionId` method in the application. This method is not recommended for use.

Vulnerabilities related to the use of this method can be categorized under the OWASP Top 10 2021 as follows:

- A4: Insecure Design

Look at the following example:

    boolean validate(HttpServletRequest request) {
        var sessionId = request.getRequestedSessionId();
        // ....
    }

When analyzing the code fragment, the analyzer will warn that the use of `getRequestedSessionId` is not recommended as it is likely to be incorrect.

The issue lies in the fact that `getRequestedSessionId` returns the ID specified by the client. As stated in the Jakarta JavaDoc:

> This may not be the same as the ID of the current valid session for this request.

To obtain the current ID, use the following option:

    boolean validate(HttpServletRequest request) {
        var sessionId = request.getSession().getId();
        // ....
    }

The same Jakarta JavaDoc states that `getSession` returns the requested session or creates a new one:

> Returns the current session associated with this request, or if the request does not have a session, creates one.

In this way, the correct session ID is obtained.

This diagnostic is classified as:

CWE-807