joomla/joomla-platform — Issue #449: Don't md5 session ids
Author: garyamort
Created: 2011-10-20 16:48:10+00:00
State: open

Formatting the session id for storage should be the responsibility of the underlying storage engine, not the session manager. Applying MD5[or any other form of hashing] has the possibility of creating the same hash for different id's - thus granting one user access to another's account. Maintain uniqueness of id as long as possible by not hashing it, and let engines format them further if they need to and note the security risk,