UUID
generation is random, but random with bad entropy means that you will end up with easy to guess UUID
s. If you use a good random number generator, you can generate UUID
s that can be used for sessions. The catch to this, however, is that UUID
s don’t have built-in re-play prevention, tampering, fixation, etc., you have to handle that on your own (read: a UUID by itself shouldn’t be considered a valid session ID by itself). That said, here’s a good snippet for how you would generate a secure UUID
using python
:
Unique session id in python