Session Id Collisions
| From: | Raymond Irving | Date: | Thu, 23 Aug 2012 04:48:12 +0000 |
| Subject: | Session Id Collisions | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-62414@lists.php.net to get a copy of this message | ||
Hello Everyone,
I've been reading that it's possible to encounter session id collisions
with the default php configuration. It's also been said that PHP utilizes a
cryptographically weak random number generator to
produce session ID information.
I know it's possible to change the hash function and entropy used in the
generation of the id but after looking at the php_session_create_id()
function in the source code, I am wondering if adding the User Agent
string to the default setup would improve the uniqueness of the id.
What do you think?
__
Raymond