title: Session Security
body: <p>I'm working on a public site which will use DB backed user sessions keyed to a session ID. I'm trying to prevent session hijacking and tampering; the session data I return to the client has limited value in and of itself, but I'd like to prevent wholesale theft. I've worked out a little scheme here, but I'd like to get some feedback and criticism.</p>
  
  <ul>
  <li>When the session begins, the client is given a unique key and a hash of their session's data.</li>
  <li>On each subsequent request the client sends a session key + the hash of their session data.</li>
  <li>If the session data is modified, the client is provided with a new hash value reflecting their session data.</li>
  <li>If a request for comes in with an incorrect hash that does not match the database, the session is flagged as compromised. The request and all subsequent requests for the session result in a new session being created by copying the compromised session. The new sessions reference the session they were copied from for security auditing purposes.</li>
  </ul>
  
  <p>I figure I can watch the requests which get compromised to scan for large-scale attacks.</p>
  
  <p>Many thanks in advance.</p>