Repository: poem-web/poem (language: rust)

Issue:
Not enought randomness in sesssion keys
## Expected Behavior

Generate [32 bytes (256 bits)](https://latacora.singles/2018/04/03/cryptographic-right-answers.html#random-ids) of randomness in `session::server_session::generate_session_id`. This can be achieved by generating 32 pseudo-random bytes and encoding them in base 64 (in url safe mode for this case).

## Actual Behavior

Generate below 24 bytes (192 bits) of randomness (log2(62**32) / 8). 

## Steps to Reproduce the Problem

1. Call `session::server_session::generate_session_id`

## Specifications

- Version: any
- Platform: any
- Subsystem: any


Discussion / hints:

Fix patch:
diff --git a/poem/CHANGELOG.md b/poem/CHANGELOG.md
index 742a92981d..a8d13d3586 100644
--- a/poem/CHANGELOG.md
+++ b/poem/CHANGELOG.md
@@ -6,6 +6,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 # Unreleased
 
+- Fixes not enough randomness in session keys([#430](https://github.com/poem-web/poem/issues/430))
+
 # [1.3.49] 2022-11-21
 
 - Bump `quick-xml` to `0.26.0`
diff --git a/poem/src/session/server_session.rs b/poem/src/session/server_session.rs
index 43e445fea4..c88a7bcdcd 100644
--- a/poem/src/session/server_session.rs
+++ b/poem/src/session/server_session.rs
@@ -36,11 +36,15 @@ impl<T: SessionStorage, E: Endpoint> Middleware<E> for ServerSession<T> {
     }
 }
 
+/// Session key generation routine that follows [OWASP recommendations].
+///
+/// [OWASP recommendations]: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-id-entropy
 fn generate_session_id() -> String {
     let value = std::iter::repeat(())
         .map(|()| OsRng.sample(Alphanumeric))
-        .take(32)
+        .take(64)
         .collect::<Vec<_>>();
+
     String::from_utf8(value).unwrap_or_default()
 }
 


Test patch: