Re: [PEN-TEST] HTTP Secure Session State Management

[Dom De Vitto <dom () DEVITTO COM>]

Can we step back a little, I'll try and recap:

A) There are a few mechanisms for holding session Ids:
        + Cookies
        + Embedded-urls (Id in the GET query)
        + Embedded hidden form fields (Id in the POST values)
any others?

B) Session ids should be a random & unique (per database), and relate to session data on the server.  It is a bad idea 
to use the 'session id' to be or hold anything else as this would allow for reverse engineering of (partially) valid 
session ids, presumebly reducing the brute-force space if the non-random part is predictable.

Right?

What else?

Dom