I am testing a Liferay application, and I am trying to figure out, how the session mechanism works. I couldn't find any good references on that. I need to know how valid sessions are distinguished from invalid sessions.
Sessions are managed by the application servers. If the browser request contains a valid session id, it will be recognized. If it doesn't, it won't.