Reputation
Top tag
Next privilege 125 Rep.
Vote down
Badges
5
Newest
 Scholar
Impact
~120 people reached

  • 0 posts edited
  • 0 helpful flags
  • 23 votes cast
Sep
15
comment Can I safely and securely store hash(sessionId) in application logs?
One more point of note - While you can use MD5 as your hashing algorithm if your sessionId has high entropy, you may want to just use SHA-1. Why? Routine security sweeps of your code may bring up a false positive and burn man hours if people find "MD5" being used for anything to do with sessions. It's fine in this case, but may cost you time regardless, having to explain why MD5 is being used, etc.
Aug
26
comment Can I safely and securely store hash(sessionId) in application logs?
and one last note, our session ids are actually 36 chars long.
Aug
26
comment Can I safely and securely store hash(sessionId) in application logs?
and Java's UUID predictability is discussed here, and sounds fine by my estimation for this use case.
Aug
26
comment Can I safely and securely store hash(sessionId) in application logs?
and this article offers some great insight into entropy and data length for hashing too.
Aug
26
awarded  Scholar
Aug
26
accepted Can I safely and securely store hash(sessionId) in application logs?
Aug
26
comment Can I safely and securely store hash(sessionId) in application logs?
Great point! Our session Ids are ~ 27 chars long and are a "type 4 (pseudo randomly generated) UUID. The UUID is generated using a cryptographically strong pseudo random number generator" docs.oracle.com/javase/7/docs/api/java/util/… So that's probably good, right?
Aug
26
awarded  Editor
Aug
26
revised Can I safely and securely store hash(sessionId) in application logs?
added note about considering adding GUID to session and tracking that instead
Aug
26
comment Can I safely and securely store hash(sessionId) in application logs?
Yeah that's part of the reason i wonder if there's a reasonable middle ground here - secure and fast. I just know that logs can make there way off of a system is all, and then access might not have been required.
Aug
26
awarded  Student
Aug
26
asked Can I safely and securely store hash(sessionId) in application logs?
Sep
30
awarded  Autobiographer
Sep
30
awarded  Supporter