Web Security · Junior · Question 50 of 75
What is a session ID, and what must it be like?
- 1A sequential number that increases with each login
- 2The user's email encoded in Base64
- ✓Correct answer: A random identifier the server links to a logged-in user; it must be long and unpredictable
Explanation
If session IDs can be guessed, an attacker can take over sessions. Use the framework's generator, which relies on a cryptographically secure random source.