Databases
StackOverflow2013
Postsdbo
POAre ServiceStack session ids secure enough?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POAre ServiceStack session ids secure enough?
    primarykey
    data
    text
    <p>From what I understand, when using ServiceStack's <a href="https://github.com/ServiceStack/ServiceStack/wiki/Authentication-and-authorization" rel="nofollow noreferrer">Authentication</a> you'd typically authenticate at the start of a session and then mark the session on the server side as authenticated. Subsequent web service requests will use that session id and not require re-authentication. (Please correct me if I'm wrong so far). </p> <p>Generation of new session ids is performed using Guid.NewGuid() in <a href="https://github.com/ServiceStack/ServiceStack/blob/master/src/ServiceStack.ServiceInterface/SessionExtensions.cs#L75" rel="nofollow noreferrer">SessionExtensions.cs</a>, which <a href="https://stackoverflow.com/a/6267578/8479">doesn't generate cryptographically fantastic values</a>. Is there any reason not to switch to use cryptographically secure values, e.g. using <a href="https://stackoverflow.com/questions/1228085/function-asp-net-uses-to-generate-session-id">RNGCryptoServiceProvider</a>?</p> <p>UPDATE: </p> <p>Actually, after thinking about it a bit further, ASP.NET doesn't use its Session Id to confirm that the requestor is authenticated. It uses a FormsAuthenticationTicket which has been encrypted with a machine key and hashed (<a href="http://msdn.microsoft.com/en-us/library/ff647070.aspx" rel="nofollow noreferrer">here's a nice description</a> of the process for ASP.NET 2.0). </p> <p>I'm not a security dude so I don't know what implication this has if you were to compare the level of security provided by ASP.NET Forms Auth and that provided by a random value. I suppose it all comes down to key and data lengths... but also the time required to mount a brute-force attack on Forms Authentication is probably much higher as it doesn't require just trying a whole heap of random numbers?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USCommunity
    1. USRory
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POAre ServiceStack session ids secure enough?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POAre ServiceStack session ids secure enough?
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POAre ServiceStack session ids secure enough?
      1. USMikeT
      1. VTFavorite
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload