When we need to provide API access to our data we want to ensure that the connection is secure. We utilize session_id’s to achieve this.
Currently, we lack the ability prevent session hijacking or session ID guessing because we can't bind session_id with other client properties, like the IP address or User-Agent.