- Store the active user’s ID in the Flask Session, and let you easily log them in and out.
However, I have seen many sources, such as OWASP [source], recommending a CSPRNG (Cryptographically Secure Pseudorandom Number Generator) approach for generating the session identifier. We also need to take into account that Flask-Login's approach also disclosures information to a malicious attacker (user id).
Although there is a session protection feature, which implements an identifier based on the IP and user-agent (which could also be forged), this question is about the level of security of the Session ID alone.
Compared to the OWASP full-random session identifier, is this approach strong enough to be considered "secure"? From what attacks could it suffer which the OWASP approach avoids?
Also, could signing a randomly generated session ID provide any significant benefits?