Index: includes/session.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/session.inc,v
retrieving revision 1.90
diff -u -p -r1.90 session.inc
--- includes/session.inc	15 Oct 2010 04:15:41 -0000	1.90
+++ includes/session.inc	29 Oct 2010 07:54:13 -0000
@@ -88,7 +88,8 @@ function _drupal_session_read($sid) {
   // a HTTPS session or we are about to log in so we check the sessions table
   // for an anonymous session with the non-HTTPS-only cookie.
   if ($is_https) {
-    $user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.ssid = :ssid", array(':ssid' => $sid))->fetchObject();
+    // Ensure that an empty secure session ID cannot be selected.
+    $user = $sid ? db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.ssid = :ssid", array(':ssid' => $sid))->fetchObject() : FALSE;
     if (!$user) {
       if (isset($_COOKIE[$insecure_session_name])) {
         $user = db_query("SELECT u.*, s.* FROM {users} u INNER JOIN {sessions} s ON u.uid = s.uid WHERE s.sid = :sid AND s.uid = 0", array(
@@ -180,21 +181,23 @@ function _drupal_session_write($sid, $va
         'timestamp' => REQUEST_TIME,
       );
 
-      // The "secure pages" setting allows a site to simultaneously use both
-      // secure and insecure session cookies. If enabled and both cookies are
-      // presented then use both keys. If not enabled but on HTTPS then use the
-      // PHP session id as 'ssid'. If on HTTP then use the PHP session id as
-      // 'sid'.
+      // For HTTP connections, use 'sid' as the session ID. Store an empty
+      // string for 'ssid', which _drupal_session_read() will prevent from being
+      // selected as a valid secure session ID.
+      $key = array('sid' => $sid, 'ssid' => '');
+      // For HTTPS connections, use 'ssid' as the secure session ID.
       if ($is_https) {
         $key['ssid'] = $sid;
-        $insecure_session_name = substr(session_name(), 1);
-        if (variable_get('https', FALSE) && isset($_COOKIE[$insecure_session_name])) {
-          $key['sid'] = $_COOKIE[$insecure_session_name];
+        // The "secure pages" setting allows a site to simultaneously use both
+        // secure and insecure session cookies. If enabled and both cookies are
+        // presented then use both keys. 
+        if (variable_get('https', FALSE)) {
+          $insecure_session_name = substr(session_name(), 1);
+          if (isset($_COOKIE[$insecure_session_name])) {
+            $key['sid'] = $_COOKIE[$insecure_session_name];
+          }
         }
       }
-      else {
-        $key['sid'] = $sid;
-      }
 
       db_merge('sessions')
         ->key($key)
Index: includes/update.inc
===================================================================
RCS file: /cvs/drupal/drupal/includes/update.inc,v
retrieving revision 1.80
diff -u -p -r1.80 update.inc
--- includes/update.inc	27 Oct 2010 19:31:53 -0000	1.80
+++ includes/update.inc	29 Oct 2010 07:54:13 -0000
@@ -701,7 +701,7 @@ function update_fix_d7_requirements() {
     }
 
     // Add ssid column and index.
-    db_add_field('sessions', 'ssid', array('description' => "Secure session ID. The value is generated by PHP's Session API.", 'type' => 'varchar', 'length' => 128, 'not null' => TRUE, 'default' => ''));
+    db_add_field('sessions', 'ssid', array('description' => "Secure session ID. The value is generated by Drupal's session handlers.", 'type' => 'varchar', 'length' => 128, 'not null' => TRUE, 'default' => ''));
     db_add_index('sessions', 'ssid', array('ssid'));
     // Drop existing primary key.
     db_drop_primary_key('sessions');
Index: modules/simpletest/tests/session.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/tests/session.test,v
retrieving revision 1.33
diff -u -p -r1.33 session.test
--- modules/simpletest/tests/session.test	15 Oct 2010 04:15:41 -0000	1.33
+++ modules/simpletest/tests/session.test	29 Oct 2010 07:54:13 -0000
@@ -316,7 +316,7 @@ class SessionHttpsTestCase extends Drupa
     // Check insecure cookie is not set.
     $this->assertFalse(isset($this->cookies[$insecure_session_name]));
     $ssid = $this->cookies[$secure_session_name]['value'];
-    $this->assertSessionIds('', $ssid, 'Session has NULL for SID and a correct secure SID.');
+    $this->assertSessionIds($ssid, $ssid, 'Session has a non-empty SID and a correct secure SID.');
     $cookie = $secure_session_name . '=' . $ssid;
 
     // Verify that user is logged in on secure URL.
Index: modules/simpletest/tests/upgrade/upgrade.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/tests/upgrade/upgrade.test,v
retrieving revision 1.9
diff -u -p -r1.9 upgrade.test
--- modules/simpletest/tests/upgrade/upgrade.test	8 Oct 2010 18:19:11 -0000	1.9
+++ modules/simpletest/tests/upgrade/upgrade.test	29 Oct 2010 07:54:13 -0000
@@ -113,7 +113,9 @@ abstract class UpgradePathTestCase exten
 
     // Force our way into the session of the child site.
     drupal_save_session(TRUE);
+    db_add_field('sessions', 'ssid', array('description' => "Secure session ID. The value is generated by Drupal's session handlers.", 'type' => 'varchar', 'length' => 128, 'not null' => TRUE, 'default' => ''));
     _drupal_session_write($sid, '');
+    db_drop_field('sessions', 'ssid');
     drupal_save_session(FALSE);
 
     // Restore necessary variables.
Index: modules/system/system.install
===================================================================
RCS file: /cvs/drupal/drupal/modules/system/system.install,v
retrieving revision 1.520
diff -u -p -r1.520 system.install
--- modules/system/system.install	20 Oct 2010 00:47:44 -0000	1.520
+++ modules/system/system.install	29 Oct 2010 07:54:13 -0000
@@ -1469,14 +1469,13 @@ function system_schema() {
         'not null' => TRUE,
       ),
       'sid' => array(
-        'description' => "A session ID. The value is generated by PHP's Session API.",
+        'description' => "A session ID. The value is generated by Drupal's session handlers.",
         'type' => 'varchar',
         'length' => 128,
         'not null' => TRUE,
-        'default' => '',
       ),
       'ssid' => array(
-        'description' => "Secure session ID. The value is generated by PHP's Session API.",
+        'description' => "Secure session ID. The value is generated by Drupal's session handlers.",
         'type' => 'varchar',
         'length' => 128,
         'not null' => TRUE,
@@ -2902,6 +2901,19 @@ function system_update_7064() {
 }
 
 /**
+ * Remove the default value for sid.
+ */
+function system_update_7065() {
+  $spec = array(
+    'description' => "A session ID. The value is generated by Drupal's session handlers.",
+    'type' => 'varchar',
+    'length' => 128,
+    'not null' => TRUE,
+  );
+  db_change_field('sessions', 'sid', 'sid', $spec);
+}
+
+/**
  * @} End of "defgroup updates-6.x-to-7.x"
  * The next series of updates should start at 8000.
  */