protected boolean isEncodeable(final String location) {

        // First check if URL rewriting is disabled globally
        if (Boolean.FALSE.equals(request.getAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED))) {
            return (false);
        }

        if (location == null) {
            return (false);
        }

        // Is this an intra-document reference?
        if (location.startsWith("#")) {
            return (false);
        }

        // Are we in a valid session that is not using cookies?
        final HttpServletRequest hreq = request;
        final HttpSession session = hreq.getSession(false);
        if (session == null) {
            return (false);
        }
        if (hreq.isRequestedSessionIdFromCookie()) {
            return (false);
        }

        return doIsEncodeable(hreq, session, location);
    }
Return <code>true</code> if the specified URL should be encoded with
a session identifier.  This will be true if all of the following
conditions are met:
<ul>
<li>The request we are responding to asked for a valid session
<li>The requested session ID was not received via a cookie
<li>The specified URL points back to somewhere within the web
application that is responding to this request
</ul>

@param location Absolute URL to be validated
@return {@code true} if the specified URL should be encoded with a session identifier, {@code false} otherwise.
web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletResponse.java