Most web apps generate a long hex number and use it as a sessionid.

My idea is to create an ID which is auto-incrementing for each generated session and assign it a random secure string (a password). Why? It is easier to look up on an int index, it is faster to update and it occupies less space.

Does this present any security risks? (I ask exclusively for the (int)id-password style; for the string generator I am pretty sure I nailed it)

  • Just to make sure I'm understanding you, you want a session cookie with a value like 123=d9f858e302de247cc86bed48b9eebbde, then server-side you look up session id 123 and check that the random string matches? – AndrolGenhald Sep 11 '18 at 15:15
  • @AndrolGenhald Yes. – Gabi Mihalcea Sep 11 '18 at 15:34
  • 1
    My initial thoughts are that you disclose the number of sessions you've had, and you'd have to be careful to make the random string comparison constant time, but it seems like it would be ok. I'm not convinced of the benefit though, it would be a good idea to do some performance tests. If you're storing sessions in sql, is an index on a 16 byte binary field really that bad? – AndrolGenhald Sep 11 '18 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.