Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Resist session id name fingerprinting by default #24

Closed
LeoniePhiline opened this issue Dec 15, 2022 · 2 comments
Closed

Resist session id name fingerprinting by default #24

LeoniePhiline opened this issue Dec 15, 2022 · 2 comments
Labels
enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed

Comments

@LeoniePhiline
Copy link

The default session cookie name gives away that axum (or this specific middleware) is used:

https://github.com/maxcountryman/axum-sessions/blob/main/src/session.rs#L112

This should be changed to a generic default, like sid, id, or ses.

See also:

https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-id-name-fingerprinting
@LeoniePhiline LeoniePhiline changed the title Resist session id name fingerprinting Resist session id name fingerprinting by default Dec 15, 2022
@maxcountryman maxcountryman added enhancement New feature or request help wanted Extra attention is needed good first issue Good for newcomers labels Dec 15, 2022
@maxcountryman
Copy link
Owner

Good find! Let's change it.

@quasiuslikecautious quasiuslikecautious mentioned this issue Mar 4, 2023
Merged
maxcountryman added a commit that referenced this issue Mar 14, 2023
@maxcountryman
Merge pull request #36 from quasiuslikecautious/resist-sid-fingerprin…
a131376 
…ting

[#24] Change default cookie name to avoid fingerprinting
@maxcountryman
Copy link
Owner

I believe this was addressed in #36.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@maxcountryman @LeoniePhiline