Hashed Sessions
Component type
Categories
Maintenance status
Development status
Downloads
Component created
Component changed
Introduction
Drupal 7 core stores session ids as is. This allows anyone with read only access to the database (via SQL-i) to take a session id, present it in a session cookie to Drupal and take over the session.
This module contains a patched core session.inc that only stores hashes of the session id. Attackers cannot offer this hash as a valid session id, nor derive the session id from the hash, nor realistically guess a string that hashes to the same value.
