customizable session key generator
- Lingua principale
- Rust
- Stelle
- 889
- Fork
- 224
- Merge medio
- 9h 37m
- PR unite (30g)
- 20
Descrizione
The [OWASP guidelines](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-id-entropy) (the same linked from the comment on `generate_session_key`) suggest that session ids should be 64 bits long, not 64 characters as implemented in `generate_session_key`. If you represent a 64 bit long integer as a hexidecimal number, it is only 16 characters long instead of 64.
Is there any chance that you might consider the following replacement for generate_session_key?
```rust
fn generate_session_key() -> SessionKey {
let key: u64 = rand::rng().random();
let key_str = format!("{:x}", key);
key_str.try_into().unwrap()
}
```
This would allow session keys to be far shorter while still complying with the OWASP guidelines. These shorter ids would take less space in storage as well. This could be really beneficial to sites with large numbers of sessions.
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.