Q:

should F12's request headers show session id as cookie?

I'm trying to educate myself on potential web attacks.  I just found a site (which will rename anonymous) where it shows me what looks to be like the php session id inside the cookies section of the request header. 
My immediate reaction was "wow, that's bad"... but then i couldn't really come up with a scenario as to how someone could use this to mess up the site. 
But maybe its because I'm a newbie to this stuff. 
But assuming that I got someone else's session id... I'd have to hack the site with their session id before it expires right? 
So my question is, how real is this threat? 
And is this common, where web developers store session ids in cookies, thereby making it visible in F12? 
Sorry for the remedial questions.
I read the article: 
Why do popular websites store very complicated session-related data in cookies -- and what does it all mean?
And i get that sometimes, you want to use cookies to move data off server to client... but I think I need more clarification on how serious a security breach this is.

A:

This SO question indicates it's not really an issue so long as you are using random numbers for your session ids and take a few other precautions like encrypting the communication channel.

