On successful authentcation, a web application issues a session cookie that is a constant length string of apparently random hex characters.
2E5F0FE4B7FCAB78CD967B46AB32915CCBFDC85316FAFB9174BDC4A3745339D8AD9C1D70A8EDD3D4F06107F3B1A67E85AEB1CB04F563818BC5D029D9E956652ED0F8F93E7A7EFD1E2E59DF1D378424964541E2C9B8A41436D0092A4114FBC4FA702A94C5090C34D97A3310F88CD3E9BDC8553230343BB1E4641F848102DF9B96AA81D6407273F774CFBD3E3FD68CAF84654B21E177A36DE7FB09EFC5A50A5253E1B5F5D6C5082A01D756CC68680FE1FBCA64CD72F1D6B1865C6FFC4B6BB8DE2C2B510731103F18DDA2289515F604632A26BD68B0E03647B854243EAFD7264B0765F45279BD6735E26D58DF720D5B9061EF316730
This session cookie is submitted for each HTTP request and the response contains a different value each time, meaning that this value is only ever used once. Any changes to this value will invalidate the session.
I usually see a session token values that is used many times for an entire auth session. In terms of the 'single use' arrangement described above, I see:
Benefits
- reduced risk of hijacked session as value is less likely to be valid when an attacker attempts use
Disadvantages
- increased computation resources required to generate non-random token each time
- possible entropy drain of host OS from constant PRNG use
Are there any other considerations that I am missing here? Thanks