Use a VARCHAR(40) Field for "sid" in sessions table

If you are using another method, what is the module implementing it ? Any module needing longer session ids could probably resize this field in their module.install file: it seems pointless to change the default size in core to a larger value than needed by core.

I'm not sure which hash you want to use. For instance, SHA-512 and Whirlpool hashes need a 64-byte value for their hashes if stored in binary, and even more if represented as hex strings, so 40 bytes wouldn't allow it anyway, and custom hashes could have other needs yet, so it seems that choosing any value above the one needed by core would be suboptimal in some way.

I'm suggesting this should not be changed and, as this is not a problem with the standard distribution but with an extension you consider using, to classify it not as a bug but as a feature request.

some recent php versions support sha1 as session id in php.ini so for that 40 bytes would be enough but usually a waste.

"...40 bytes would be enough but usually a waste."

If it's a varchar field though, is there any waste? I thought MySQL only allocated enough bytes to store whatever the field contained?

I agree that we need a patch for this.

Marking as bug, because Drupal does not address the fact that it does not work with SHA1 as stated by #3

I believe this has been fixed in HEAD; I am inclined to mark ot "won't fix" for 4.7.

Indeed. Database changes in stable releases shouldn't happen unless there are critical bugs to fix; I'm not sure how one goes about getting SHA-1 session IDs, but it seems like a configuration change that needs to be made specially and thus not common.

http://drupal.org/node/78732 is the 5.x version of this bug with a patch, btw, if anyone wants to work on a backport.

Confirmed and to e ported according webchick indication.

Upgrate to Drupal 5 if you need this.