Cryptographically Secure Session Management with Token Hashing

Why AI coding tools introduce this vulnerability

// AI-Generated Session Creator (VULNERABLE)
export async function createSession(userId: string) {
  const rawToken = crypto.randomUUID();
  // Storing plaintext token in DB!
  await db.query('INSERT INTO sessions (token, user_id) VALUES ($1, $2)', [rawToken, userId]);
  return rawToken;
}

import crypto from 'crypto';

export async function createHashedSession(userId: string): Promise<string> {
  // 1. Generate 256-bit CSPRNG raw token
  const rawToken = crypto.randomBytes(32).toString('hex');

  // 2. Hash token with SHA-256 before database insertion
  const tokenHash = crypto.createHash('sha256').update(rawToken).digest('hex');

  await db.query(
    'INSERT INTO sessions (token_hash, user_id, expires_at) VALUES ($1, $2, NOW() + INTERVAL \'14 days\')',
    [tokenHash, userId]
  );

  // 3. Return only raw token to client in __Host- cookie
  return rawToken;
}