Session IDs are now hashed in the database in Drupal 7

Drupal 7 now stores a hash of user's session ID in the database, instead of the ID itself. This is a security improvement as it means that a compromise of the database is less likely to result in the ability to hijack user sessions.

system_update_7086() will update all existing user sessions in the database, so user's session cookies should continue to work.

If any D7 sites need to opt out of this change - for example because they have contrib or custom code that relies on accessing session IDs directly in the database - there is a variable to allow this:

/**
 * Session IDs are hashed by default before being stored in the database. This
 * reduces the risk of sessions being hijacked if the database is compromised.
 *
 * This variable allows opting out of this security improvement.
 */
# $conf['do_not_hash_session_ids'] = TRUE;

It is important to set this variable before running the database update in order to avoid existing sessions being invalidated (resulting in all users being logged out).

Note that it's also possible to provide an alternative session.inc implementation in Drupal 7, but that should not be necessary if opting out of the hashing of session IDs is the only requirement.