Re: [VOTE] Secure Session Module Options/Internal by Default

Hey, I didn't want to interrupt a vote, but this 'id_length' setting was not initially a part of the RFC and it's just now that I see it. I don't see how it relates to timing attacks. If it is about comparing at least N characters of the session ID before rejecting one, then why not just compare all of them? ID length is public information, anybody can see what it is by simply looking at what the application gives them. And finally, the setting name itself is misleading - it doesn't make it clear that it's about minimum length. Cheers, Andrey.