Printable View
Is anyone aware of any research that has been done on the algorithm that generates this value?
A number of .NET applications have crossed my path in recent months and I'm always dissapointed to see how random the numbers are in successive new connection requests.
as far as my knowledge goes on asp/net that is how it is done the numbers are made to generate in random,if the numbers are the same some one can easly copy them and log on to another account.
Good Day,
And… so the sessions do not collide and of course it makes it harder to guess the existing session’s ID.Quote:
yourdeadin: if the numbers are the same some one can easly copy them and log on to another account.
Yep I was just at a site about another ASP question and lo and behold:Quote:
Is anyone aware of any research that has been done on the algorithm that generates this value?
“The SessionIDModule class generates a session ID as a 120-bit random number and represents it as a string of 20 alphanumeric characters. The session ID can be stored in either a HTTP cookie or a mangled URL, based on the value of the cookieless attribute in the <sessionState> configuration section.”
http://www.vsj.co.uk/articles/display.asp?id=286
In C# it would look similar to:
byte[] sessionkey = new byte[15];
RNGCryptoServiceProvider rngkey =
new RNGCryptoServiceProvider (); //Generates a random number
rngkey.GetBytes (sessionkey);
string clientsessionKey = SessionId.Encode (sessionkey);
http://www.codeproject.com/aspnet/as...tstatmgmnt.asp
In ASP.NET 2.0 you can create session ID’s. This is accomplished by replacing the normally created SessionIDModule with one of your own. However do not forget the reason why the numbers are randomized in the first place.Quote:
I'm always dissapointed to see how random the numbers are in successive new connection requests.
Hope that helps.
Cheers