title: Is session ID hashing more secure than plain storage?
body: <p>I have a PHP/MySQL app where I store session data in my database. Here's some pseudocode for the relevant handlers:</p>
  
  <pre><code>function session_read($sessionId) {
      $result = query('select session_data from sessions where id = ?', $sessionId);
      if(!$result) $result = array('session_data' =&gt; '');
      return $result['session_data'];
  }
  
  function session_write($sessionId, $data) {
      query('replace into session_data set data = ? where id = ?', $data, $sessionId);
      return true;
  }
  </code></pre>
  
  <p>It occurs to me that for the duration of a session, that the session ID can be as sensitive as a user's password. I am wondering if hashing the session ID before evaluating it would afford additional security?</p>
  
  <pre><code>function session_read($sessionId) {
      $sessionId = hash('sha512', $sessionId);
      $result = query('select session_data from sessions where id = ?', $sessionId);
      if(!$result) $result = array('session_data' =&gt; '');
      return $result['session_data'];
  }
  
  function session_write($sessionId, $data) {
      $sessionId = hash('sha512', $sessionId);
      query('replace into session_data set data = ? where id = ?', $data, $sessionId);
      return true;
  }
  </code></pre>
  
  <p>In this way, even if an attacker managed to retrieve a dump of the sessions table they would not easily be able to craft a cookie to hijack any user sessions.</p>
  
  <p>Is this a useful practice?</p>
  
  <p>EDIT: The site is served over HTTPS, and the cookie is HTTPONLY.</p>