# V5316\. Do not use the 'HttpServletRequest\.getRequestedSessionId' method because it uses a session ID provided by a client\.

The analyzer has detected the use of HttpServletRequest\.getRequestedSessionId method in the application\. This method is not recommended for use\.

Vulnerabilities related to the use of this method can be categorized under the [OWASP Top 10 2021](https://owasp.org/Top10/) as follows:

* [A4: Insecure Design](https://owasp.org/Top10/A04_2021-Insecure_Design/)

Look at the following example:

```cpp
boolean validate(HttpServletRequest request) {
    var sessionId = request.getRequestedSessionId();
    // ....
}
```

When analyzing the code fragment, the analyzer will warn that the use of `getRequestedSessionId` is not recommended as it is likely to be incorrect\.

The issue lies in the fact that `getRequestedSessionId` returns the ID specified by the client\. As stated in the [Jakarta JavaDoc](https://jakarta.ee/specifications/platform/10/apidocs/jakarta/servlet/http/httpservletrequest#getRequestedSessionId()):

> This may not be the same as the ID of the current valid session for this request\.

To obtain the current ID, use the following option:

```cpp
boolean validate(HttpServletRequest request) {
    var sessionId = request.getSession().getId();
    // ....
}
```

The same [Jakarta JavaDoc](https://jakarta.ee/specifications/platform/10/apidocs/jakarta/servlet/http/httpservletrequest#getSession()) states that `getSession` returns the requested session or creates a new one:

> Returns the current session associated with this request, or if the request does not have a session, creates one\.

In this way, the correct session ID is obtained\.