A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to authenticate the user.
This scheme is vulnerable to someone (an angry DBA perhaps) sniffing the token out of the DB and hijacking the user's session. Keeping the session token store in memory increases the difficulty of sniffing the key, but it is still not impossible.
What is the generally accepted way of securely storing session tokens?