session_manager can't be reasonably overridden

There are lots of problems with SessionManager

Indeed. And it is sad that it takes ages for session-patches to get committed.

1. +++ b/core/lib/Drupal/Core/Session/SessionManager.php
   @@ -406,4 +395,32 @@ protected function getSessionDataMask() {
   +   * @param $old_session_id
   ...
   +   * @param $is_https
   ...
   +   * @param $new_insecure_session_id
   

   Missing type-hints in @param annotation: string, bool, string.

2. +++ b/core/lib/Drupal/Core/Session/SessionManager.php
   @@ -406,4 +395,32 @@ protected function getSessionDataMask() {
   +  protected function regenerateStorage($old_session_id, $is_https, $new_insecure_session_id) {
   

   Perhaps use migrateStoredSession. "Migrate" is the term used in the public facing API (SessionInterface).

This issue is a normal bug fix, and doesn't include any disruptive changes, so it is allowed per https://www.drupal.org/core/beta-changes. Committed 44f8f78 and pushed to 8.0.x. Thanks!

diff --git a/core/lib/Drupal/Core/Session/SessionManager.php b/core/lib/Drupal/Core/Session/SessionManager.php
index 4eb9ff5..5bf7d10 100644
--- a/core/lib/Drupal/Core/Session/SessionManager.php
+++ b/core/lib/Drupal/Core/Session/SessionManager.php
@@ -410,7 +410,7 @@ protected function getSessionDataMask() {
   protected function migrateStoredSession($old_session_id, $is_https, $new_insecure_session_id) {
     $fields = array('sid' => Crypt::hashBase64($this->getId()));
     if ($is_https) {
-      $fields['ssid'] = Crypt::hashBase64($this->getId());
+      $fields['ssid'] = $fields['sid'];
       // If the "secure pages" setting is enabled, use the newly-created
       // insecure session identifier as the regenerated sid.
       if ($this->isMixedMode()) {

Tiny optimisation fix on commit - so we're not hashing the same value twice within the space of 3 lines of code.