Session Token Length

[gregorskii]

Issue Description

OWASP recommends session tokens should be 128 bit. Parse sessions are currently 32 bit:

parse-server/src/cryptoUtils.js

Line 43 in de79b70

return randomHexString(32);

https://owasp.org/www-community/vulnerabilities/Insufficient_Session-ID_Length

Steps to reproduce

No reproduction needed, code attached.

Expected Results

Session token to be a minimum of 128 bits, or be of configurable length for flexibility.

Actual Outcome

Session tokens are 32 bit.

Environment Setup

• Server

  • parse-server version : 4.2.0
  • Operating System: Linux
  • Hardware: Ubuntu / Cloud Server
  • Localhost or remote server? GCS

• Database

  • MongoDB version: 3.6.18
  • Storage engine: N/A
  • Hardware: N/A
  • Localhost or remote server? Cloud Atlas

[mtrezza]

The current session token has 32 HEX characters, that's 128 bit entropy, so we should be good.

[gregorskii]

Derp thank you.