thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Session Token Entropy

The unpredictability of a session identifier, which must be high enough that guessing a valid one is infeasible.

Definition

OWASP recommends at least 64 bits of entropy from a cryptographically secure random generator; many frameworks use 128 bits or more. Predictable tokens built from timestamps, user IDs or sequential counters enable session prediction attacks.

Example

A token built from the username and login time can be predicted and forged.

Exam tip

Use the framework's built-in session generator rather than a custom one.

Related terms