I need to know what will the valid characters in a session id or in particular whether it can have spaces in it .?

closed as off topic by AJ Henderson, Luc, lynks, Gilles, user2213 Apr 26 '13 at 17:30

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What kind of session id? Why is this not off-topic on a security forum? – symcbean Apr 25 '13 at 12:49
  • you need to give more details. – Shurmajee Apr 25 '13 at 13:01
  • jsessionid in case of a banking application – Arun Apr 25 '13 at 14:20
  • jsessionid in case of a banking application eg(1) :- urls:jsessionid=**sessionidvalue**?query .eg(2) :- urls:jsessionid=**sessionidvalue** . in these two cases the session id value ends in ? in one and a " " in the other hence the question can a session id contain spaces. I just need to know whether there is a standard for this . – Arun Apr 25 '13 at 14:26

"Session ID" is a general concept used in many places. It is "a name for a session". Whenever you have a session and you want to designate it (e.g. in a message in a network protocol), whatever you use to designate it is the "session ID". It can contain any characters or bytes that the said protocol says it can contain.

Every protocol is free to define things at it sees fit. In the case of SSL, for instance, there is a notion of "session", and the "session identifiers" used by the protocol are sequences of 1 to 32 bytes (all byte values from 0 to 255 are acceptable, but there shall be no more than 32 such bytes). In the case of PHP, which also has a notion of session, the "protocol" is an agreement between PHP, the site code and a PHP module called the "session handler"; there, session ID are sequences of characters, and the session handler can enforce some limitations, which depend on the specific session handler in force.

  • I have a web application using jsp jsessionids in it .. i need to track this session id to do which i have to parse the session id from a url using C . which is why i need to know whether the jsession id value can/cannot contain spaces in it so i can decide on the list of delimiters using which i can pick the value – Arun Apr 25 '13 at 14:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.