Send a blank email to [email protected] to get a copy of this message
Hey,
I didn't want to interrupt a vote, but this 'id_length' setting was
not initially a part of the RFC and it's just now that I see it.
I don't see how it relates to timing attacks.
If it is about comparing at least N characters of the session ID
before rejecting one, then why not just compare all of them? ID length
is public information, anybody can see what it is by simply looking at
what the application gives them.
And finally, the setting name itself is misleading - it doesn't make
it clear that it's about minimum length.
Cheers,
Andrey.