You need to take additional measures to actively protect the integrity of the session, depending on the value associated with it.
A visitor accessing your web site is assigned an unique id, the so-called session id. This is either stored in a cookie on the user side or is propagated in the URL.