Moving away from UUIDs – Neil Madden
If you need an unguessable random string (for a session cookie or access token, for example), it can be tempting to reach for a random UUID, which looks like this: 88cf3e49-e28e-4c0e-b95f-6a68a785a…
Moving away from UUIDs – Neil Madden Moving away from UUIDs If you need an unguessable random string (for a session cookie or access token, for example), it can be tempting to reach for a random UUID , which looks like this: 88cf3e49-e28e-4c0e-b95f-6a68a785a89d This is a 128-bit value formatted as 36 hexadecimal digits separated by hyphens. In Java and most other programming languages, these are very simple to generate: import java.util.UUID; String id = UUID.randomUUID().toString(); Under the hood this uses a cryptographically secure pseudorandom number generator (CSPRNG), so the IDs ge
related reading
- Myths about /dev/urandom2uo.de
- JWT should not be your default for sessionsevertpot.com
- Why We Don’t Trust the Database With Authentication – Sturdy Statisticsblog.sturdystatistics.com
- passwords - Demystifying Web Authentication (Stateless Session Cookies) - Information Security Stack Exchangesecurity.stackexchange.com
- Discovering cryptographic weaknesses with Claude \ Anthropicanthropic.com
- Part 2: Complete User Authentication: Sessions vs JWT | by Nick Jagodzinski | Mediummedium.com
- When Life Gives You Lemons, Make Random Numbersblog.demofox.org
- Library Functions | CS 161 Spring 2024sp24.cs161.org
- Lavaranden.wikipedia.org
- /dev/random - Wikipediaen.wikipedia.org
- Pseudorandom Number Generators | Computer Securitytextbook.cs161.org
- Themes from Real World Crypto 2022 - The Trail of Bits Blogblog.trailofbits.com