code: public HttpSession getSession(final HttpServletRequest servletRequest) {
          final HttpSession session;
          final String txId = getEmbeddedId(servletRequest, Prefix.TX);
  
          try {
              if (txId == null) {
                  session = createSession(servletRequest);
              } else {
                  session = getSessionFromTransaction(servletRequest, txId);
              }
          } catch (final SessionMissingException e) {
              LOGGER.warn("Transaction missing: {}", e.getMessage());
              return null;
          }
  
          return session;
      }
docs: Get a JCR session for the given HTTP servlet request with a
  SecurityContext attached
  
  @param servletRequest the servlet request
  @return the Session
  @throws RuntimeException if the transaction could not be found