This is a natural consequence of session attributes not being type-safe. Suppressing the warning is fine if you know for sure that your application always assigns the same type to that attribute.
What's more problematic is your naming. It looks like your Cart class encapsulates a single entry of a shopping cart. So why is it called Cart and not something like CartEntry?
If you write a separate Cart class that encapsulates a Map<String, CartEntry> (after all, why are IDs represented by int? Are you going to use arithmetic on them?) you can cast the attribute to Cart and you won't get a warning: