Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p><strong>UPDATE: 2016-12-21</strong></p> <p>A lot has happened in a the last ~5yrs. <code>/dev/urandom</code> has been updated and is now considered a high-entropy source of randomness on modern Linux kernels and distributions. In the last 6mo we've seen entropy starvation on a Linux 3.19 kernel using Ubuntu, so I don't think this issue is "resolved", but it's sufficiently difficult to end up with low-entropy randomness when asking for any amount of randomness from the OS.</p> <hr> <p>I hate to say this, but none of the other solutions posted here are correct with regards to being a "secure session ID." </p> <pre><code># pip install M2Crypto import base64, M2Crypto def generate_session_id(num_bytes = 16): return base64.b64encode(M2Crypto.m2.rand_bytes(num_bytes)) </code></pre> <p>Neither <code>uuid()</code> or <code>os.urandom()</code> are good choices for generating session IDs. Both may generate <strong>random</strong> results, but random does not mean it is <strong>secure</strong> due to poor <strong>entropy</strong>. See "<a href="http://www.reteam.org/papers/e59.pdf" rel="noreferrer">How to Crack a Linear Congruential Generator</a>" by Haldir or <a href="http://csrc.nist.gov/groups/ST/toolkit/rng/index.html" rel="noreferrer">NIST's resources on Random Number Generation</a>. If you still want to use a UUID, then use a UUID that was generated with a good initial random number:</p> <pre><code>import uuid, M2Crypto uuid.UUID(bytes = M2Crypto.m2.rand_bytes(num_bytes))) # UUID('5e85edc4-7078-d214-e773-f8caae16fe6c') </code></pre> <p>or:</p> <pre><code># pip install pyOpenSSL import uuid, OpenSSL uuid.UUID(bytes = OpenSSL.rand.bytes(16)) # UUID('c9bf635f-b0cc-d278-a2c5-01eaae654461') </code></pre> <p>M2Crypto is best OpenSSL API in Python atm as pyOpenSSL appears to be maintained only to support legacy applications.</p>
    singulars
    1. This table or related slice is empty.
    1. POUnique session id in python
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USSean
    1. USSean
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COThose citations about UUID problems are helpful. Thanks for posting that. Question: what do you think is the best way to generate a session id? Particularly with the faults you cite in UUID implementations, how would you do it differently? I'm writing something like this right now and trying to come up with the best approach. It's also got to be fault-tolerant - e.g., can't be dependent upon connection to a database server.
      singulars
      1. PO
      1. USratsbane
    2. COAny of the examples above would work. The key is making use of a good random number generator that is populated with "cryptographically sufficient entropy." Beyond aesthetics and the size of the representation, there is no difference between a encoding a sufficiently random value as a `Base64` string or a `UUID`, or even a hex encoded string. To each their own. I personally prefer base64 for size reasons.
      singulars
      1. PO
      1. USSean
    3. COThanks. That seems sound. I wrote it this afternoon with
      singulars
      1. PO
      1. USratsbane
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload