I'm considering storing a hash of a user's session ID in our applications logs on each request. This would allow users sessions to be easily tracked back to actions in our logs.
I understand that storing this is a potential security risk, which i may be willing to consider if the risk is very low. Why is it a risk? If anyone that has access to the logs can figure out how to get a session ID, then they can essentially steal that users session and login as them without credentials.
To that end, if I was going to do this, what's the best way to do this?
Here are some things I'd like considered:
- Which hashing algorithm should I use ? It needs to be fast.
- What should I hash ? Session ID + Salt?
- How risky is this? Should I just not do this?
EDIT: I'm considering just generating a GUID and adding it to a users session on session creation. Then logging this instead. That way it'd always be unique for the sessions lifetime. The problem with this is that it would add more session data and require more session memory for each user. With this approach no hashing would be required, and the user's session could still be uniquely tracked.