lprimak commented on code in PR #2759:
URL: https://github.com/apache/shiro/pull/2759#discussion_r3393198947
##########
core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java:
##########
@@ -30,7 +30,11 @@
* implementation is a {@link java.security.SecureRandom SecureRandom} with
the {@code SHA1PRNG} algorithm.
*
* @since 1.0
+ * @deprecated since 2.0. Use {@link JavaUuidSessionIdGenerator} instead. This
class uses only 64 bits of entropy
Review Comment:
Can you change this to `@since 2.2.1` to make it accurate
##########
core/src/main/java/org/apache/shiro/session/mgt/eis/RandomSessionIdGenerator.java:
##########
@@ -30,7 +30,11 @@
* implementation is a {@link java.security.SecureRandom SecureRandom} with
the {@code SHA1PRNG} algorithm.
*
* @since 1.0
+ * @deprecated since 2.0. Use {@link JavaUuidSessionIdGenerator} instead. This
class uses only 64 bits of entropy
+ * which is below modern industry minimums (128 bits per OWASP
ASVS and NIST SP 800-63B) and poses
+ * a security risk if used in production.
*/
+@Deprecated
Review Comment:
This should be annotated with `forRemoval=true` and `since=2.2.1` as well
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
