Contents
Is it necessary to hash your session ID?
Session tokens should be generated with a Cryptographically Secure random number generator. The session tokens should have 72 bits of entropy or more. For the foreseeable future, a 72-bit random token will be globally unique, so Salt is not necessary. Pro [to hashing] The attacker can’t read the [plain session token] to send directly.
Do you need to Salt your session ID?
With salt the id’s won’t look the same in the database, even if they are. With salt the id’s won’t look the same in the database, even if they are. Session tokens should be generated with a Cryptographically Secure random number generator. The session tokens should have 72 bits of entropy or more.
Can a malicious user get my session ID?
SQL injection– either against your public site or an administrative management site — May allow a malicious user to obtain a session ID in real time, meaning they could impersonate any user. See also this article
Is it possible for session tokens to be stolen?
A fairly common security procedure is to use separate database user accounts, so it is possible that the session tokens could be stolen with a read-only SQLi (i.e. limited access database user), with the most sensitive data remaining secure (i.e. requires special purpose database user)
Why is it insecure to store the session ID in a?
Just like strong random session ids, the hash size must match the security requirements of the specific application it is meant to protect. This is because at the end, the session cookie is still just a string and open to guessing attacks. Session ids must be sufficiently long and impractical to guess.
How does the server know if a session is invalid?
By including an integrity component in the session id (via a hash or signature), the server can immediately tell the difference between an expired session, an unallocated session id, and an invalid session.