Unique Id for what?
In general, I strongly discourage using any system's identifier for any purpose outside of it's stated purpose. The reason is that systems change and they're not expecting you to be using their session id for your system.
And so they change their behavior - which then may break your system.
Thus to be less risky - don't use the
Java session identifier for your own unique identity. Instead generate your own unique ids. The simplest approach (assuming you're doing this for a database) - is to create a function that simply returns a counter (start with 1 and each request increments that number).
Make it static and synchronized to minimize chances of two users with the same id.
And then use a database or text file to remember the last count when your system shutsdown.
Mark