I am creating a session authentication token and sending it to the client application. Any user data etc is associated to this token on the database, so the token does not contain any sensitive information.
Is it enough to just create a random token? One kind of attack that occurred to me is just brute-forcing tokens. How can I prevent that? Encrypting the token seems to be just as susceptible to such an attack. Maybe HMAC?