A-sessionC-improvementgood first issue
Repository metrics
- Stars
- (889 stars)
- PR merge metrics
- (PR metrics pending)
Description
The OWASP guidelines (the same linked from the comment on generate_session_key) suggest that session ids should be 64 bits long, not 64 characters as implemented in generate_session_key. If you represent a 64 bit long integer as a hexidecimal number, it is only 16 characters long instead of 64.
Is there any chance that you might consider the following replacement for generate_session_key?
fn generate_session_key() -> SessionKey {
let key: u64 = rand::rng().random();
let key_str = format!("{:x}", key);
key_str.try_into().unwrap()
}
This would allow session keys to be far shorter while still complying with the OWASP guidelines. These shorter ids would take less space in storage as well. This could be really beneficial to sites with large numbers of sessions.