I am creating a session authentication token and sending it to the client application. Any user data etc is associated to this token on the database, so the token does not contain any sensitive information.

Is it enough to just create a random token? One kind of attack that occurred to me is just brute-forcing tokens. How can I prevent that? Encrypting the token seems to be just as susceptible to such an attack. Maybe HMAC?


1 Answer 1


No need for any encryption or HMAC or anything else fancy like that. Some things you need to think about, though:

  • The protection against brute forcing is entropy. Pick a random number from a large enough space and an attacker would need millenia to guess one right. OWASP recommends at least 128 bits.
  • Make sure to use a cryptographically secure PRNG go generate the session IDs, so that there is no pattern in the generated session IDs. If you use a bad PRNG an attacker can guess upcoming IDs based on previous IDs.
  • Since it is not directly related to the generation of tokens I will not go into any length about it, but make sure to think about things such as session fixation, the HTTP-only and secure flags, etc. OWASP has a good cheat sheet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.