The subject comes up here fairly regularly. But you have had some good advice already. Let me add a couple of comments:
  1. It is never a good idea to use a PID, GID, or machine related value as even a seed for an ID. It can easily result in identical values being generated. In fact I tested this. Using a dual PIII-933 machine with mod-perl and an ID based on pid and time as you are proposing, I got the same ID produced on 31 ocassions out of 2,350,000 requests and on one ocassion got the same ID 4 times in succession. Very very insecure!
  2. Using Apache::Session or CGI::Session (I prefer the latter - it is much more flexible and works much the same - it is modelled on the former.) using MD5 hashes is good. Even better is using SHA-1 digest pattern which is 160 bits long rather than the 128 bits of the MD-5 digest.
  3. You should change the cookie-id regularly - if you can. If you tie the value to your session then make sure the session does not persist across browser sessions. If it does, then you should track authentication on top of that.
  4. I take the MD5 session value from CGI::Session, concatenate the TIME with it and the username then I encrypt the whole lot using Blowfish. That way I can decrypt on the next request and make sure that the time value is the same as that which I have in the session record so that I can be sure that requests are being handled serially. If I get a time skip then I have either lost a request or a response, if this occurs more than once in 64 request/response cycles then either their is something funny going on or the client has an extremely poor connection!
Whatever you choose, good luck!

jdtoronto

In reply to Re: unique cookie id? by jdtoronto
in thread unique cookie id? by rkg

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.