actix / actix/actix-extras

customizable session key generator

Aperta
#497 6 commenti 0 reazioni 0 assegnatari Vedi su GitHub
A-session C-improvement good first issue
Lingua principale
Rust
Stelle
889
Fork
224
Merge medio
9h 37m
PR unite (30g)
20

Descrizione

The [OWASP guidelines](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-id-entropy) (the same linked from the comment on `generate_session_key`) suggest that session ids should be 64 bits long, not 64 characters as implemented in `generate_session_key`. If you represent a 64 bit long integer as a hexidecimal number, it is only 16 characters long instead of 64.

Is there any chance that you might consider the following replacement for generate_session_key?

```rust
fn generate_session_key() -> SessionKey {
let key: u64 = rand::rng().random();
let key_str = format!("{:x}", key);
key_str.try_into().unwrap()
}
```

This would allow session keys to be far shorter while still complying with the OWASP guidelines. These shorter ids would take less space in storage as well. This could be really beneficial to sites with large numbers of sessions.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.