note 16547 deleted from function.session-id by jimw

Unless you REALLY know what you're doing you probably shouldn't mess with the session id generation algorithm. Generating cryptographic-quality random numbers (and, consequently, random strings) is difficult, and noone in this forum has come even close. <p> Why does it matter? Because if I can predict your random sequence then I can generate the same session id you generated. I append that to a URL on your site and I've just hijacked that session. <br> Things like this:<br> md5($REMOTE_ADDR.$REMOTE_PORT.time()); are trivial to break.<br> Imagine I want to take over your site, www.domain.com. I send you an email reporting some minor bug or issue. You send me an email back telling me you fixed it, you don't know what I'm talking about, whatever. I look at the headers of your email and pull your IP address out and I've got one ingredient in your session id recipe. Your port lies between 1025 and 65535 (and is actually even more restricted), and the time you last logged in to your site, assuming I know how to write a leading e-mail, lies between the time I mailed you and the time you replied (depending on how you're using sessions you may or may not have generated a new session id, but there are certainly ways to increase the likelihood of this). It is not difficult then to brute-force the time interval and port combinations, generate the md5 hashes and find your sessionid. Game Over. <br> Similarly, taking over the session of the guy that was at the library computer just before me is even easier... <br> The best you can hope for using the proposed weak methods above is that security-through-obscurity will save you. Security-through-obscurity is not security. The standard session id mechanism does not depend upon security through obscurity. Using it also gives you plausible deniability, which is worth a lot more than feeling leet for writing your own session id function until someone steals all your customers' data. <br> As an additional security note the use of mt_srand() needs to be watched closely. You should call mt_srand() *only once* during the execution of a program -- do not embed mt_srand in a function which generates random numbers. The security of mt_rand() is greatly reduced if you call mt_srand() every time you generate a random number. <br> The proper means of generating these ids uses the maximum entropy available and ideally includes a long random string not deducible from outside the system generating id's. The default session id algorithm does a good job of this. Use it unless you really know what in the hell you're doing.