APEX

Hello guys! I was just wondering if the calculated checksum in session state protection can be calculated by a client.
Let's assume a hacker modifies the criteria in the url and provides a matching checksum he would succeed in hacking the app.

I was not able to find something about successful checksum manipulation but am not sure whether it is absolutely impossible or not!

Thanks for your answers!

Seb