From b276bdb6cc87d4ba8e3d975d99359a04aba0ba16 Mon Sep 17 00:00:00 2001 From: Brad Arant Date: Wed, 26 Aug 2026 11:12:41 -0700 Subject: [PATCH] Guard against a session id collision: check the session file does not already exist, regenerate if it does A RAND_bytes()-generated 160-bit session id colliding with an existing session file is astronomically unlikely, but the check is cheap and removes any dependence on that probability - regenerates (up to 5 attempts, then throws) rather than ever reusing an existing sessions file. --- __jet.cpp | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/__jet.cpp b/__jet.cpp index dac1e6a..cb6ee12 100644 --- a/__jet.cpp +++ b/__jet.cpp @@ -24,6 +24,20 @@ namespace jet { // follow sessiontimeoutredirecturl. } else { SessionId sessionId; + // A 160-bit CSPRNG value colliding with an existing session file + // is astronomically unlikely, but cheap to guard against outright + // rather than trust the probability - regenerate on an actual + // collision instead of ever reusing another session's file. + int sessionIdAttempts = 0; + while(true) { + coreutils::MString candidatePath; + candidatePath << resolveKeyword("sessiondir") << "/" << sessionId << ".json"; + if(access(candidatePath.c_str(), F_OK) != 0) + break; + if(++sessionIdAttempts >= 5) + throw coreutils::Exception("could not generate a unique session id after multiple attempts."); + sessionId = SessionId(); + } global.headers["Set-Cookie"] << "session=" << sessionId; global.cookies.data["session"] = sessionId; sessionIdValue = sessionId;