Repository: poem-web/poem (language: rust)

Issue:
Not enought randomness in sesssion keys
## Expected Behavior

Generate [32 bytes (256 bits)](https://latacora.singles/2018/04/03/cryptographic-right-answers.html#random-ids) of randomness in `session::server_session::generate_session_id`. This can be achieved by generating 32 pseudo-random bytes and encoding them in base 64 (in url safe mode for this case).

## Actual Behavior

Generate below 24 bytes (192 bits) of randomness (log2(62**32) / 8). 

## Steps to Reproduce the Problem

1. Call `session::server_session::generate_session_id`

## Specifications

- Version: any
- Platform: any
- Subsystem: any


Discussion / hints:

Fix patch:
diff --git a/poem/src/session/server_session.rs b/poem/src/session/server_session.rs
index 242e8c7fc6..247aa876aa 100644
--- a/poem/src/session/server_session.rs
+++ b/poem/src/session/server_session.rs
@@ -1,7 +1,7 @@
 use std::sync::Arc;
 
-use base64::URL_SAFE;
-use rand::{thread_rng, RngCore};
+use base64::URL_SAFE_NO_PAD;
+use rand::{thread_rng, Rng};
 
 use crate::{
     middleware::{CookieJarManager, CookieJarManagerEndpoint},
@@ -41,9 +41,8 @@ impl<T: SessionStorage, E: Endpoint> Middleware<E> for ServerSession<T> {
 ///
 /// [OWASP recommendations]: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-id-entropy
 fn generate_session_id() -> String {
-    let mut random_bytes = [0u8; 32];
-    thread_rng().fill_bytes(&mut random_bytes);
-    base64::encode_config(random_bytes, URL_SAFE)
+    let random_bytes = thread_rng().gen::<[u8; 32]>();
+    base64::encode_config(random_bytes, URL_SAFE_NO_PAD)
 }
 
 /// Endpoint for `ServerSession` middleware.


Test patch: