Bit strength of JSESSIONID?

[mkane1]

Our security folks are proposing new coding standards, one being "Use session identifiers of at least 128 bits long". Sorry if I missed it, but I can't find how many bits is JSESSIONID, does anyone know?

[Adam Cameron. · Accepted solution]

You should be able to work this out for yourself.

Looking @ a jsessionid value, you can see it's a 36 digit hexadecimal number.  Each hexadecimal digit is four bits long.  36x4=144 bits.

As an aside, I'm rather surprised it's 36 digits long, rather than just a UUID (32 digits long).  Anyone else know why?

--

Adam

[mkane1]

Thanks Adam. hexadecimal? bits long? I never understood that kind of math!

[Adam Cameron.]

I guess I'm old school... we needed to know this stuff back when I started out.  I s'pose it's less important to know these days.

But that's no reason for you to not find out:

http://en.wikipedia.org/wiki/Hexadecimal

--

Adam