Secure authentication cookie for web site

Question

Hello i want to know if this auth token is secure enough for a site of millions of logged in users:

BAQAAAT7Y/BHPAAaAAJ0AAaAKLZowMDAwMDAwMAFkAAJTii2aI2EACAAeUdCHGjEzNjk4NDUyOTl4MzIxMTMzOTcyMjA0eDEwMXgyWQAzAAlTii2aNjUwMTAsSVRBAMsAAVGpASIxABAADlOKLZpyb2JlcnRvcGFzc2VyaQBAAA5Tii2acm9iZXJ0b3Bhc3NlcmkA8wAiU4otmiQyJFA3enZoS2xTJGY5Ly9sUTRVcWNGQkJwd25DODE2ZDAAygAgWw77mmE1NmNiN2U5MTNlMGE1NjFjNTU2MDMwNmZmODRmOTMwAU0AGVOKLZo1MWExZGRmYS4xMDEuMS43LjQ2LjAuMC4yAAQADlODEWdyb2JlcnRvcGFzc2VyaQCcADhTii2ablkrc0haMlByQm1kajZ3Vm5ZK3NFWjJQckEyZGo2dvvv0Zrb0dsREpXS29RdWRqNng5blkrc2VRPT0BTAAaU4otmjUxYTYyZTMzLjEwMS4xLjMuMTAwLjEuMC4yreIRtwcAv5JgOcJxVKcOY7Jx1X0

With 10 million connected users how much hard is to guess a valid token?

Which features should it have? Consider that the content of the cookie travels up and down the server to each request so it can't be too easy

It is safe to set this cookie via HTTPS but read it in each HTTP page?

Answer 1

So here's how this works: we tend to consider 128 bits of random data unguessable. See Why so long to break 128-bit encryption? for some talk about that.

What you want to do is calculate the birthday attack. There are some other questions talking about this in What are the chances to generate the same ssh key? and What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?.

Your token there looks like it's Base64 encoded, so it provides 6 bits per character. That's over 3,000 bits of data. Encode something smaller (128 bits raw, 170+ in B64) and save yourself the bandwidth.

For the second part of your question, see How is an HTTPS login secure when pages use HTTP?.