3 ms·
if someone is dumb enough to use guessable session ids (instead of, e.g. uuids), then they'd be also dumb enough to use guessable bearer tokens.
by stefs 4y ago
if someone is dumb enough to use guessable session ids (instead of, e.g. uuids), then they'd be also dumb enough to use guessable bearer tokens.
- noisem4ker 4y agoTo prevent guessing, the session ID must be cryptographically signed (and possibly encrypted) by the server, with the signature appended to it. Upon receiving it back from the client, the server needs to check it wasn't tampered with. This guarantees an attacker may not simply generate random session IDs until someone else's is found and their session is hijacked, because they wouldn't know how to fake the signature.