Laravel accept session not generated by server?

I have a Laravel 5.7 application that is pen test by a customer and one of the finding is "The application should only accept server-generated session tokens (those for which a session is already defined on the server side)." Is this possible? And how do I fix this?

Thank you. Neena K.

via Chebli Mohamed