4 ms·
The way I see it is that session ids are handed out by the server as you login and revoked when you log out, so while it would be advisable for this session ids
by ilovetux 4y ago
The way I see it is that session ids are handed out by the server as you login and revoked when you log out, so while it would be advisable for this session ids to be truly random there is no guarantee that this is the case. In truth I have seen sessions stored with an autoincrement id meaning that if you were to get a session id you could, in theory, just use the number before yours and highjack someone else's session.
A bearer token, in my experience, is a cryptographically generated random key (presumably unguessable) which the user can create, use and revoke at will.
- stefs 4y agoif someone is dumb enough to use guessable session ids (instead of, e.g. uuids), then they'd be also dumb enough to use guessable bearer tokens.
- noisem4ker 4y agoTo prevent guessing, the session ID must be cryptographically signed (and possibly encrypted) by the server, with the signature appended to it. Upon receiving it back from the client, the server needs to check it wasn't tampered with. This guarantees an attacker may not simply generate random session IDs until someone else's is found and their session is hijacked, because they wouldn't know how to fake the signature.