Are GUIDs generated on Windows 2003 safe to use as session IDs?
问题 My web application operates only over SSL and sets a time limited cookie for each user after they successfully login with a username and password. The biggest weaknesses in the system are one compromising an existing user's cookie. And two guessing a session ID GUID. I know of mechanisms for the first weakness but I'm wondering how much I need to worry about the chance of an attacker guessing a session ID GUID based on a GUID they have previously obtained by logging into an account they have