public String encodeURL(String url) {
        String absolute = toAbsolute(url);
        if (isEncodeable(absolute)) {
            // W3c spec clearly said
            if (url.equalsIgnoreCase("")) {
                url = absolute;
            }
            return toEncoded(url, request.getSession().getId());
        } else {
            return url;
        }
    }
Encode the session identifier associated with this response
into the specified URL, if necessary.

@param url URL to be encoded
web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletResponse.java