On successful authentcation, a web application issues a session cookie that is a constant length string of apparently random hex characters.
This session cookie is submitted for each HTTP request and the response contains a different value each time, meaning that this value is only ever used once. Any changes to this value will invalidate the session.
I usually see a session token values that is used many times for an entire auth session. In terms of the 'single use' arrangement described above, I see:
- reduced risk of hijacked session as value is less likely to be valid when an attacker attempts use
- increased computation resources required to generate non-random token each time
- possible entropy drain of host OS from constant PRNG use
Are there any other considerations that I am missing here? Thanks