For a rich client web app, on the server I need to verify that each call comes from a legally logged in user. Obviously user ID is not enough, because that's easy to guess.
I have an idea I am skeptical about, but can't think of rational reasons not to do it.
Is using password hash protected with a sufficiently strong hashing function (bcrypt?) a good session identifier? It already is in DB, is unique for each user and cannot be guessed easily. I am using a secure channel (HTTPS) for all communications between the client and server, so I don't have to worry about eavesdropping on the session identifier.
I don't care about session expiration, state or being logged in from two computers at a time. The server app is stateless enough. All I really need is user ID and some extra means of verification that he has logged in properly.