I already learned that including advertisements banners bears some risk. It seems that our company already made the decision to accept this risk for this partner.
Now I am worried about one particular point. The data that the partner wants us to send also includes our customer's session id, in order to "recognize double requests" as the partner states. I think we should not sent the real session id to the partner, because with this information the partner could fake the customer's identity on our site. Therefore, I would like to send a hash of the session id instead. With this, the partner should still be able to recognize double requests without being able to fake the customer's identity.
If it makes sense to hash the session id, what hash function would be a good choice?