different libraries have different implementations, as you can see below debug. Or you can just navigate to the implementation with the code view function of ide. In this way, you can only have a rough look. It is easier for you to understand debug by yourself

    @Override
    public HttpSession getSession(boolean create) {

        if (request == null) {
            throw new IllegalStateException(
                            sm.getString("requestFacade.nullRequest"));
        }

        if (SecurityUtil.isPackageProtectionEnabled()){
            return AccessController.
                doPrivileged(new GetSessionPrivilegedAction(create));
        } else {
            return request.getSession(create);
        }
    }

check the entry method of debug