I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon sessions and wiped them from memory. The only downside of that is that I have a channel that holds all session names so overseer can repeatedly loop through them.
So, in order to keep sessions indexable by their name, I was thinking about appending sessions with a unique rotating validation token separated by some delimiter. e.g. session cookies would be stored as "sessionid|validationToken." Is this less secure or any different than rotating the entire session ID? Both validation token and session id will use UUID so they will be uniquely identifiable. Also, is this really any different than rotating the entire session id?
This is in reference to session fixation/session hijacking