@Override
    public Serializable getSessionId(SessionKey key) {
        Serializable id = super.getSessionId(key);
        if (id == null && WebUtils.isWeb(key)) {
            ServletRequest request = WebUtils.getRequest(key);
            ServletResponse response = WebUtils.getResponse(key);
            id = getSessionId(request, response);
        }
        return id;
    }
Stores the Session's ID, usually as a Cookie, to associate with future requests.

@param session the session that was just {@link #createSession created}.
web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java