The session id coming back in the HTTP request message from the user is the same as the session id the server wrote out originally as part of the cookie you created with the request.getSession(true) statement.

Given that, all you normally need to do in order to test for a valid session is the following:

    HttpSession session = request.getSession(false);
    if (session != null)
       System.out.println("Found valid session");
    else
       System.out.println("No session found");

Jorgen