Index: modules/system/system.install
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.install,v
retrieving revision 1.520
diff -u -p -r1.520 system.install
--- modules/system/system.install	20 Oct 2010 00:47:44 -0000	1.520
+++ modules/system/system.install	29 Oct 2010 02:51:03 -0000
@@ -1469,18 +1469,16 @@ function system_schema() {
         'not null' => TRUE,
       ),
       'sid' => array(
-        'description' => "A session ID. The value is generated by PHP's Session API.",
+        'description' => "A session ID. The value is generated by Drupal's session handlers.",
         'type' => 'varchar',
         'length' => 128,
         'not null' => TRUE,
-        'default' => '',
       ),
       'ssid' => array(
-        'description' => "Secure session ID. The value is generated by PHP's Session API.",
+        'description' => "Secure session ID. The value is generated by Drupal's session handlers.",
         'type' => 'varchar',
         'length' => 128,
         'not null' => TRUE,
-        'default' => '',
       ),
       'hostname' => array(
         'description' => 'The IP address that last used this session ID (sid).',
Index: includes/session.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/session.inc,v
retrieving revision 1.90
diff -u -p -r1.90 session.inc
--- includes/session.inc	15 Oct 2010 04:15:41 -0000	1.90
+++ includes/session.inc	29 Oct 2010 02:51:03 -0000
@@ -180,21 +180,18 @@ function _drupal_session_write($sid, $va
         'timestamp' => REQUEST_TIME,
       );
 
+      // Fill both sid and ssid with the session ID. An empty string session ID
+      // would be easy to guess, leading to session impersonation.
+      $key = array_fill_keys(array('sid', 'ssid'), $sid);
       // The "secure pages" setting allows a site to simultaneously use both
       // secure and insecure session cookies. If enabled and both cookies are
-      // presented then use both keys. If not enabled but on HTTPS then use the
-      // PHP session id as 'ssid'. If on HTTP then use the PHP session id as
-      // 'sid'.
-      if ($is_https) {
-        $key['ssid'] = $sid;
+      // presented then use both keys. 
+      if ($is_https && variable_get('https', FALSE)) {
         $insecure_session_name = substr(session_name(), 1);
-        if (variable_get('https', FALSE) && isset($_COOKIE[$insecure_session_name])) {
+        if (isset($_COOKIE[$insecure_session_name])) {
           $key['sid'] = $_COOKIE[$insecure_session_name];
         }
       }
-      else {
-        $key['sid'] = $sid;
-      }
 
       db_merge('sessions')
         ->key($key)