Also notice that you in most implementations where clients can choose their own value for sessionId, malicious injected scripts can use a session fixation attac

Also notice that you in most implementations where clients can choose their own value for sessionId, malicious injected scripts can use a session fixation attack to then exfiltrate your info. They don’t need to craft a special link, as long as they inject a script into your site it’s game over. That’s why your server should sign session IDs it generates with an HMAC and reject any ones that the client simply sets! The client can overwrite httponly but it will only log the user out and annoy them.