5 ms·

You think mistakes can't be made with session ids? Anyways, there are well trusted libraries out there for JWT.

• marcus_holmes 10y ago
  I don't understand. A session key is just a lookup key for a database table. What mistakes are made?
  • DenisM 10y ago
    There are tricks there too. If you just lookup in the database, I could find out how much time it took to retrieve the strings, this will leak the session id over time. Databases don't do constant-time data retrieval. You would have to come up with a way to retrieve the session token from the database at constant time, or at least time that does not betray the session id.
    • marcus_holmes 10y ago
      But the session id isn't sensitive, is it? I mean most session verification middleware checks the ip address of the request against the address of the session login. If the address's don't match you kill the session and force another login. I usually just put the session id in a cookie and use https to encrypt the whole stream shrug