wali-reheman opened a new pull request, #2759: URL: https://github.com/apache/shiro/pull/2759
Marks RandomSessionIdGenerator as @Deprecated with a Javadoc pointing to JavaUuidSessionIdGenerator. The class only provides 64 bits of entropy via Long.toString(SecureRandom.nextLong()), below the 128-bit minimum required by OWASP ASVS and NIST SP 800-63B for session tokens. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
