Study. uk . com
  1. Home
  2. All questions
  3. Question 287

CompTIA Security+ study material · question 287 of 611

Which property must a session identifier have?

  1. It should encode the user's identifier for traceability
  2. It should increment predictably to detect gaps
  3. It should be derived from a hash of the username
  4. It should be long and generated by a cryptographically secure random generator
Show the answer

Answer: D. It should be long and generated by a cryptographically secure random generator

A counter or a derived value can be predicted, which lets an attacker guess a valid session without stealing one.

Source: OWASP Session Management Cheat Sheet (OWASP) — OWASP Session Management Cheat Sheet › Session ID Properties

Challenge yourself on this topic → Study as cards