TYPO3 Core

Current sesssion identifiers in TYPO3 are a MD5 representation of several parameters.
Due to several security requirements it might be necessary to have at least a 160bit session identifier (MD5 has only 128bit) - e.g. using SHA1 or SHA2.

Furthermore it should be ensured that a session identifier really was created by the TYPO3 system. It's not critical at all currently since a brute force attack against a 128bit value takes some time. However, the session id used in the cookie should have another hash that uses the encryption key to ensure that it really was created by the accordant TYPO3 website.

(issue imported from #M11280)