customizable session key generator
- Vorherrschende Sprache
- Rust
- Sterne
- 889
- Forks
- 224
- Ø Merge
- 9 Std. 37 Min.
- Gemergte PRs (30 T.)
- 20
Beschreibung
The [OWASP guidelines](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-id-entropy) (the same linked from the comment on `generate_session_key`) suggest that session ids should be 64 bits long, not 64 characters as implemented in `generate_session_key`. If you represent a 64 bit long integer as a hexidecimal number, it is only 16 characters long instead of 64.
Is there any chance that you might consider the following replacement for generate_session_key?
```rust
fn generate_session_key() -> SessionKey {
let key: u64 = rand::rng().random();
let key_str = format!("{:x}", key);
key_str.try_into().unwrap()
}
```
This would allow session keys to be far shorter while still complying with the OWASP guidelines. These shorter ids would take less space in storage as well. This could be really beneficial to sites with large numbers of sessions.
Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.