Increase the length of the ASP.NET Session ID

SecureAuth Idp Version affected:  All

Description:  

The ASP .NET Session ID is a 24 character string by default.  Each character is using a form of Base32 encoding, allowing each character to encode 5 bits, giving a total Session ID length of 120 bits.

Cause: 

Some security policies or recommendations may require that the Session ID length be increased to 160 bits or more. 

Resolution:  

It is not currently possible to change the Session ID length.  

Product enhancement request EE-177 has been created to research increasing the length of the Session ID.  An enhancement has been rejected on the basis that OWASP (Open Web Application Security Project) regards the default .NET implementation for the random session as sufficient.

"Microsoft ASP.NET, making use of 120-bit random numbers for its session IDs that can provide a very good effective entropy, and as a result, can be considered long enough to avoid guessing or brute force attacks"

 For further information on Session ID length see the following articles:

https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Session_ID_Length

https://msdn.microsoft.com/en-us/library/system.web.sessionstate.sessionidmanager.aspx

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.