Autowiring HttpSession give different object than HttpServletRequest

Question

I use Spring Security, and I found strange behavior of framework while login. Spring Security WebAuthenticationDetails has parameter sessionId which is getting from HTTP request, and it all should be good, but in fact REST request gives me another session id. If I will autowire HttpSession and then get session id from it, I will get Spring-like id. So it seems that I have two ids for one user. Is it correct? Or I missed something?

EDITED:

For example this class will gave some session id

public class AuthenticationEventListener implements ApplicationListener<AbstractAuthenticationEvent> {

    @Autowired
    HttpSession httpSession;

    @Override
    public void onApplicationEvent(AbstractAuthenticationEvent event) {
        if (event instanceof AuthenticationSuccessEvent) {
            LoggedUser loggedUser = (LoggedUser) event.getAuthentication().getPrincipal();
            loggedUser.initSessionParams(event.getAuthentication());
            String sessionId = httpSession.getId();
        }
    }
}

and this method will give another one:

@RequestMapping(value = "/chart")
public Map getTestStatusesChart(HttpServletRequest request) {
    String sessionId= request.getSession(false).getId();
    return null;
}

Answer 1

So the answer is next: with condition of security Spring change session id by default. To prevent such behavior you need to disable session-fixation-protection in Spring Security config. more info by link