In a Drupal 7 site taken over from an ex-colleague, sessions for anonymous user always are generated as this screenshot shows.
The security-scanning service provider always claims:
Our company also observed that the application sets the SSESSd84a1fe63b666c4294afc5029aa95bfd cookie prior to authentication and it doesn't update the value of the session cookie even after authentication but, as the user is not able to fix the session by updating the cookie, it was not reported as a separate finding.
I'm a novice Drupaler. I installed a new Drupal 7 site from scratch, and there isn't a session cookie, but there is one in Drupal.org. I also checked contributed modules in my site, disabled the most suspicious 2 modules (login_destination and betterlogin), still no luck. I added a line "ini_set('session.cookie_lifetime', 0);" in settings.php file, no luck again. I don't know how to do next.