Session ID Rotation - does it enhance security?

Posted by dound on Stack Overflow See other posts from Stack Overflow or by dound
Published on 2010-05-17T02:52:56Z Indexed on 2010/05/17 3:00 UTC
Read the original article Hit count: 332

Filed under:
|
|

(I think) I understand why session IDs should be rotated when the user logs in - this is one important step to prevent session fixation.

However, is there any advantage to randomly/periodically rotating session IDs?

This seems to only provide a false sense of security in my opinion. Assuming session IDs are not vulnerable to brute-force guessing and you only transmit the session ID in a cookie (not as part of URLs), then an attacker will have to access your cookie (most likely by snooping on your traffic) to get your session ID. Thus if the attacker gets one session ID, they'll probably be able to sniff the rotated session ID too - and thus randomly rotating has not enhanced security.

© Stack Overflow or respective owner

Related posts about session

Related posts about best-practices