actix / actix/actix-extras

customizable session key generator

Offen
#497 6 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
A-session C-improvement good first issue
Vorherrschende Sprache
Rust
Sterne
889
Forks
224
Ø Merge
9 Std. 37 Min.
Gemergte PRs (30 T.)
20

Beschreibung

The [OWASP guidelines](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-id-entropy) (the same linked from the comment on `generate_session_key`) suggest that session ids should be 64 bits long, not 64 characters as implemented in `generate_session_key`. If you represent a 64 bit long integer as a hexidecimal number, it is only 16 characters long instead of 64.

Is there any chance that you might consider the following replacement for generate_session_key?

```rust
fn generate_session_key() -> SessionKey {
let key: u64 = rand::rng().random();
let key_str = format!("{:x}", key);
key_str.try_into().unwrap()
}
```

This would allow session keys to be far shorter while still complying with the OWASP guidelines. These shorter ids would take less space in storage as well. This could be really beneficial to sites with large numbers of sessions.

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.